The problem with many security products is the tuning of rules, and in layman's terms, it is necessary to make judgments about what is normal and what is not for that network. However, this is a challenge for many companies and requires a lot of process and effort. Many of the NDR products can automatically generate thresholds for each company using the automatic learning function by AI. This allows you to effortlessly create a “normal” for your corporate network in a matter of weeks or months.

NDR solutions go beyond setting thresholds and often employ a security framework to enable more advanced detection. There are a certain number of people in the company who are working on tasks that are different from the operations performed by many people in charge, and there is a high possibility that false positives will occur with simple threshold generation. Therefore, in order to enable more sophisticated detection, some products have adopted a security framework, and when an attacker continues to perform their intended actions, the level of security events is greatly increased and an alert is issued. It implements the functionality to be

When any security event is detected, it becomes important to go back in time and scrutinize the event. Many of these attacks are likely to be events that compromised other internal networks, so it is necessary to identify a wide range of impact. At that time, NDR in particular becomes a very effective tool for primary investigation in incident response. This is because not only PCs and servers, but also all terminals with IP addresses such as multi-function devices and IoT devices are subject to monitoring. .

Here, I will specifically touch on endpoints and SIEM integration. As mentioned above, NDR is particularly strong in early detection of attacks and critical events in the initial phase, but cooperation with endpoint products is important in that response. Recently, solutions such as EDR (Endpoint Detection and Response) have been released, and this solution can deeply track events that occur at endpoints. Since the platforms on which it is implemented are limited, it is highly compatible with "NDR for early detection at a surface" and "EDR for deep detection at a point". In addition, for companies whose corporate network is controlled by SIEM, it is possible to build a more advanced security policy by deploying NDR logs to SIEM.