Cybersecurity definition
What is NDR?
NDR stands for Network Detection and Response.
By Cyber Tool Stack Editorial TeamUpdated
Definition
Detection and response built around monitoring network traffic rather than endpoint or log data, catching attacker behavior like lateral movement and command-and-control that never touches a monitored endpoint.
Where NDR fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
EDREndpoint Detection and ResponseSoftware that continuously records what happens on endpoints (processes, files, network connections) and detects, investigates, and responds to malicious behavior.XDRExtended Detection and ResponseExtends endpoint detection and response by correlating telemetry from identity, email, and cloud systems alongside endpoint activity, so a single attack spanning multiple systems appears as one connected incident instead of scattered alerts.C2Command and ControlThe infrastructure and channel an attacker uses to remotely control malware already running on a compromised system — issuing commands, exfiltrating data, or pulling down additional tools.