Network Detection and Response: Turning Telemetry Into Verdicts

By Taylor Thomas · 2026-09-27

Network detection and response is the layer that turns network telemetry into detections. A flow record is testimony — this host spoke to that one, at this hour, moving this many bytes — but testimony is not a verdict. Somebody has to know that this workstation has never spoken to that server before, that this volume is fifty times the host’s usual, that this beaconing cadence looks like software rather than a person. NDR products do that job: they model the observed behavior of the entities on the network and alarm when behavior departs from the model. The category is what the analyst world earlier called network traffic analysis; the rename added the response half — what the product lets you do about a finding.

From Records to Baselines

The mechanism that distinguishes the category — not the only one its products carry — is behavioral. The system observes traffic long enough to build a baseline per entity — what a host, a server, a subnet normally does: which peers, which ports, which volumes, which hours — and then scores departures from it. On top of the anomaly engine sit detections oriented to attack behaviors — reconnaissance sweeps, command-and-control beaconing, data staging and exfiltration patterns — and policy-style rules the operator defines, such as an alarm on any flow from a production segment to an address block the business has no relationship with. The strength of the approach is that it can catch what no signature describes, in traffic that is individually unremarkable: a host reaching peers it has never touched, a server that suddenly browses the network, the slow gathering of data before it leaves. (Basic flow records generally do not identify the account behind the behavior — that takes identity context exported or correlated in, which is one reason the ISE integration below matters.) The cost is that a baseline takes time to become trustworthy, and tuning is real work — an anomaly is not automatically an incident.

Context makes the judgments sharper. Grouping entities by role — these addresses are the domain controllers, these are the guest wireless pool, these are the payment servers — lets detection policy, alarm thresholds, and an investigator’s reading fit the role: traffic that is routine for a backup server is alarming from a receptionist’s workstation. In Secure Network Analytics that grouping is the host group structure, and investing in it early goes a long way toward an alarm queue an analyst trusts rather than one they learn to ignore.

The Sensor Is the Network You Already Own

NDR’s telemetry usually comes from equipment already deployed. Cisco’s NDR product is Secure Network Analytics — Stealthwatch, before the rename — and its architecture reads as a consumer of the network’s own reporting: Flow Collectors ingest, store, and analyze the NetFlow and IPFIX exported by routers, switches, and firewalls, and the detections happen there; a Manager aggregates and presents the Flow Collectors’ analyses and provides the management and investigation surface. Where infrastructure cannot export flow — or where richer detail is wanted — an optional Flow Sensor generates telemetry from traffic mirrored or tapped to it. That design is why flow-based NDR can reach interior, east-west traffic that perimeter appliances never see: coverage extends wherever flow export can be switched on and collected.

Detection Without Payload

Flow-based behavioral detection works from metadata — who, when, how much, how often — not payload, so encryption reduces what it sees rather than eliminating it. The peer relationships, timing, and volumes of an encrypted flow remain observable at the exporter — though a tunnel such as tunnel-mode IPsec aggregates the sessions inside it and hides their inner peers from that vantage point — and enriched telemetry such as Cisco’s Encrypted Traffic Analytics adds observable characteristics of encrypted sessions without decrypting them. The honest caveat travels with the strength: a verdict reached from metadata is probabilistic. Metadata analysis can say this flow behaves like exfiltration; it cannot quote the stolen file. Where content must be proven, decryption or endpoint evidence still carries that weight.

Closing the Loop

The response half has two directions. Upward, NDR alarms feed the platforms that carry cross-domain correlation: forwarded to a SIEM or XDR, a network-grounded detection lands next to endpoint, identity, and cloud evidence and becomes part of a correlated incident. Downward, toward containment: Secure Network Analytics can integrate with ISE over pxGrid, so a containment decision can apply an Adaptive Network Control policy to the offending endpoint, which ISE enforces through the network access device serving that session, where the device and session support the control.

Where the Blueprint Puts It

Secure Network Analytics is not named as a product objective on the current SCOR 350-701 v2.0 blueprint — the retired blueprint listed it explicitly, as 6.7.a Cisco Stealthwatch — but the v2.0 foundations are squarely there: objective 2.2 covers security monitoring and telemetry technologies, and 6.6 covers network visibility and enforcement using telemetry and native AI/ML capabilities with XDR and SIEM/SOAR platforms. An engineer who can explain how a flow record becomes a baseline, a baseline becomes an alarm, and an alarm becomes a quarantine has the mechanism those objectives are really asking about — and it is the same mechanism you build and watch work in a hands-on lab.

Frequently Asked Questions

Is NDR the same thing as an IDS or IPS?

No. An IDS/IPS inspects traffic in or near real time — signatures, protocol analysis, and often anomaly methods of its own — and an IPS sits inline to block. NDR typically consumes telemetry out of band and judges behavior over time — a slow data-gathering pattern no single packet would trip. The categories overlap, but their centers of gravity differ, and many networks run both.

Does network detection and response work on encrypted traffic?

Largely yes, because behavioral detection works from metadata rather than payload: addresses, timing, volumes, and peer patterns remain observable under encryption. Tunnels are the real limit: an IPsec tunnel hides the sessions inside it from an outside observation point. Enriched telemetry such as Cisco's Encrypted Traffic Analytics adds observable characteristics of encrypted sessions, but metadata-based analysis cannot read content — a verdict about an encrypted flow is probabilistic, not proven from payload.

Do I still need a SIEM or XDR if I deploy NDR?

It depends on what else you must answer for. NDR can stand alone: it retains and analyzes network telemetry, and a flow archive is durable forensic evidence — as complete as its retention and exporter coverage. Its evidence is the network's, though; when the requirement is correlation, retention, or case work across endpoint, identity, cloud, and application sources too, that is the job a SIEM or XDR exists for, with NDR alarms as one of the feeds.