Typical network evidence
- Source and destination.
- Ports and protocols.
- Connection frequency and timing.
- Bytes and direction.
- DNS activity.
- Internal versus external communication.
RR CYBERLAB • Network Security
NDR Fundamentals
Understand how network detection and response provides flow and communication context for investigations.
QUICK READ
NDR focuses on network behavior: who communicated, where, when, how often and over which protocols. It is especially useful when endpoint visibility is limited.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Investigation workflow
- Identify the initiating asset.
- Determine whether the destination is expected.
- Review repeated or periodic connections.
- Check DNS and related endpoint evidence.
- Look for communication with multiple internal systems.
Example
A workstation contacts the same external destination every 60 seconds. The analyst should correlate the destination, DNS, process and user context before deciding whether the behavior resembles beaconing.Common mistakes
- Treating unusual traffic as automatically malicious.
- Ignoring east-west traffic.
- Failing to correlate network and endpoint data.
Daily quiz hook
What does NDR add to an investigation when endpoint process telemetry is unavailable?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
Network detection and response uses network observations to identify patterns across devices and services. Visibility depends on sensor placement, encryption, routing, retention, and whether the traffic path actually crosses the sensor.
Compare the fictional DNS and connection records with an expected baseline. Check for NAT, shared services, and legitimate periodic traffic before treating a repeated flow as suspicious; combine network evidence with endpoint context.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.