But with an EDR comes missing pieces. Deploying a network detection and response (NDR) solution can offer you fuller coverage and go beyond endpoint detection to predict malicious traffic.

EDR Benefits and Shortcomings

Endpoint detection and response (EDR) solutions monitor your endpoints to detect suspicious activity and take defensive action. EDRs tend to run all the detection analytics on the endpoints and use central managers for federated search.

Where EDRs can be deployed, they provide efficacy in:

• Detecting cyberattacks occurring at endpoints such as laptops, phones, and other devices connected to the network.
• Analyzing the endpoint data for patterns to determine whether activity is suspicious.
• Finding malware residing in memory, which might otherwise be missed by anti‑virus solutions.
• Alerting on threats and blocking attacks.

However, there are situations where EDRs cannot be effectively deployed. For example:

• Regulations, incompatibility, and lack of access may restrict necessary endpoint agents from being installed in a system.
• Systems may be created dynamically in the cloud or other virtual instances without notice to the security teams.
• Systems may have unreliable connections to the infrastructure.
• The agent software required on the endpoint could be exploited.
• Events beyond a single endpoint may not be correlated, so the EDR may fail to identify a complex cyberattack involving multiple endpoints.
• EDRs may miss polymorphic malware, which changes as it spreads.

NDR Advanced Features

Network detection and response (NDR) solutions combine machine learning, advanced analytics, and rule-based matching to find suspicious network activities. After determining baseline behavior, NDR tools detect abnormal traffic and predict whether it is malicious. NDRs typically centralize data collection like a Security Information and Event Management (SIEM) system does, and NDRs perform analytics and detection within a central platform.

Expanding beyond what EDRs can do, NDRs provide additional capabilities that include:

• Integrating feeds from endpoint, network, and other sources such as Active Directory to perform cyber data analytics.
• Providing visibility into devices that cannot run EDR agent software.
• Adding centralized machine learning and artificial intelligence-based analytics across all the feeds over a hybrid attack surface.

BluVector is an example of an NDR solution that can work with your existing cyber security infrastructure to strengthen your network visibility and increase the speed and efficacy of your SOC team. BluVector provides:

• A machine learning engine trained on a decade of experience
• In-situ machine learning that customizes to your environment
• A speculative code execution engine to find fileless malware
• Detection of zero-day and polymorphic threats
• Targeted logger capabilities to correlate events before and after an attack
• A tuning assistant to reduce false positives
• Operation at wire speed

Learning More about Deploying NDRs

While EDR solutions provide efficacy where they can be deployed, NDR solutions provide coverage where EDRs cannot. Additionally, NDR solutions employ advanced analytic methods to predict which traffic is malicious based on behavior that appears abnormal compared to a baseline.

For more information about the BluVector cyber security platform or to see a demo in action, contact us today.