According to IDC analysts
Capabilities to look for
 |
NDR vendors must support contemporary metrics and frameworks such as risk scoring, alert prioritization, MTTD/MTTR (mean time to detect, mean time to respond), and MITRE ATT&CK™ |
|
[NDR must] explain what happens to encrypted traffic (i.e. inline decryption) |
|
NDR platforms must integrate well with other tools 1 |
Significant market developments
|
Integration of NDR with threat intelligence and IP address and DNS monitoring services |
|
Adding attack surface management (ASM) either as a feature on an NDR platform or in a formal integration becoming a requirement |
|
NDR taking a proactive approach to cybersecurity by being able to lead periodic security health checks of the network2 |
See full list→
Network Detection and Response (NDR)
Recognized as a Representative Vendor
Must have capabilities:
|
Deliver, via physical or virtual sensors, form factors compatible with on-premises and cloud networks to analyze raw network packet traffic or traffic flows (for example, IP flow information). |
|
Model normal network traffic and highlight unusual traffic activity that falls outside the normal range. NDR must also provide detection based on behavioral techniques (non-signature-based detection), including machine learning (ML) and advanced analytics that detect network anomalies. |
|
Aggregate individual alerts into structured incidents to facilitate threat investigation and provide automatic or manual response capabilities to react to the detection of malicious network traffic. |
Read the report→
2024 Gartner Market Guide for Network Detection and Response (NDR)
Section 1 - Column 3. Praesent non velit ut libero
condimentum pulvinar sed vitae tellus.
Vestibulum
id tristique elit. Suspendisse posuere rutrum
sodales. Nam id elit ac sem iaculis lacinia
posuere vitae metus.
Section 1 - Column 4. Praesent non velit ut libero
condimentum pulvinar sed vitae tellus.
Vestibulum
id tristique elit. Suspendisse posuere rutrum
sodales. Nam id elit ac sem iaculis lacinia
posuere vitae metus.
“ NDR is a technology central to the vision of extended detection and response (XDR) and helps fulfill the vision of combining the speed of endpoint detection and response (EDR) alerts with the using of network to figure out what the blast surface could be.”
– Chris Kissel, Research Vice President, Security and Trust at IDC
Read full report→
Section 2 - Column 3. Praesent non velit ut libero
condimentum pulvinar sed vitae tellus.
Vestibulum
id tristique elit. Suspendisse posuere rutrum
sodales. Nam id elit ac sem iaculis lacinia
posuere vitae metus.
Section 2 - Column 4. Praesent non velit ut libero
condimentum pulvinar sed vitae tellus.
Vestibulum
id tristique elit. Suspendisse posuere rutrum
sodales. Nam id elit ac sem iaculis lacinia
posuere vitae metus.
1Christopher Kissel & Monika Soltysik, Worldwide Network Detection and Response Forecast, 2024–2028: The Network Is Talking, Are You Listening?, IDC Market Forecast, March 2024
2Ibid
Section 4 - Column 3. Praesent non velit ut libero
condimentum pulvinar sed vitae tellus.
Vestibulum
id tristique elit. Suspendisse posuere rutrum
sodales. Nam id elit ac sem iaculis lacinia
posuere vitae metus.
Section 4 - Column 4. Praesent non velit ut libero
condimentum pulvinar sed vitae tellus.
Vestibulum
id tristique elit. Suspendisse posuere rutrum
sodales. Nam id elit ac sem iaculis lacinia
posuere vitae metus.