Corelight Open NDR
Network detection and response based on Zeek and Suricata.
Logging & Monitoring
Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Addresses 152 stories in our coverage in the last 90 days 3 products that provide it
What it is
Analysis of network traffic to spot lateral movement, command-and-control traffic and data theft, including from devices that cannot run a security agent.
How to value it
Printers, industrial equipment, appliances and unmanaged devices cannot run endpoint protection, and attackers know it. Network detection covers those blind spots, and is often how intrusions that slipped past endpoint tools get caught.
Questions to ask a vendor
- 1How does it handle encrypted traffic?
- 2Does it cover cloud network traffic as well as on-premises?
- 3How many alerts a day should we expect, and how are they prioritised?
- 4Can it work with our endpoint tools and SIEM to respond?
For your risk register
- Risk
- Lateral movement and data theft through devices without endpoint protection.
- Control
- NDR on core network segments and cloud.
- Owner
- Security operations lead.
- Measure
- Share of internal traffic monitored.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Darktrace / NETWORK
Network detection and response based on learning normal behaviour.
Vectra AI Platform
Detection of attacker behaviour across network, identity and cloud.
Recent stories it addresses
500 stories in total- 13 Nov 2026Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks
Hackers used AI agents powered by DeepSeek and GLM to breach 10 organizations autonomously.
- 13 Nov 2026PHP2Shell Exploited in Destructive Check Point Gateway Attacks
Attackers exploit PHP2Shell and CVE-2026-123039 to deploy wipers on Check Point gateways.
- 13 Nov 2026Hackers Exploit New N-central Zero-Day Hours After PoC Publication
Hackers exploit N-central zero-day vulnerability hours after PoC publication, deploying XMRig miner.
- 12 Nov 2026Kazakhstan-linked hackers used AI agent to spy on Central Asian governments
Kazakhstan-linked hackers used an AI agent to spy on Central Asian governments.
- 12 Nov 2026Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching
Hackers use GSocket backdoor to maintain Linux server access post-patching.
- 12 Nov 2026Hackers plant GSocket on Linux servers for persistent access
Hackers are using GSocket, a legitimate remote access tool, to maintain persistent access on Linux servers.
- 11 Nov 2026The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are using GSocket on Linux servers to maintain access after vulnerabilities are patched.
- 11 Nov 2026Poland shuts down government services platform ePUAP following cyberattack
Poland shuts down government services platform ePUAP following cyberattack.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.