--- title: "Network Detection and Response (NDR)" slug: "network-detection-and-response-ndr" updated: 2026-11-03T10:21:16Z published: 2026-11-03T10:21:16Z canonical: "docs.trellix.com/network-detection-and-response-ndr" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.trellix.com/llms.txt > Use this file to discover all available pages before exploring further. # Network Detection and Response (NDR) ![How Trellix Network Detection and Response (NDR) Works](https://cdn.us.document360.io/0d453a50-e1da-4d4a-9409-fea7959614d8/Images/Documentation/NDR-HIW.png?sv=2026-02-06&spr=https&st=2026-11-12T04%3A28%3A14Z&se=2026-11-12T05%3A28%3A14Z&sr=c&sp=r&sig=fGRBT%2Bc5KnbRoBy4bqZKRiLf2YDxO5Oat9rObFE9n7U%3D) Trellix NDR correlates network sensor telemetry, threat intelligence, and Trellix Wise™ AI analysis to detect lateral movement and automate response across IT, cloud, and OT environments. Trellix Network Detection and Response (NDR) delivers AI-powered visibility, real-time threat detection, and automated response across IT, OT, and ICS environments. Available in Essentials, Core, and Enterprise editions, Trellix NDR unifies five core capabilities: - **NDR Console & Visibility** — Risk-prioritized alert analysis, asset discovery, and IT/OT MITRE ATT&CK views. - **NDR Sensor & Packet Capture (PX)** — High-speed L7 metadata and selective PCAP in Defend, Boost, or Flare modes. - **AI Investigation & Forensics** — Trellix Wise™ (GenAI) triage plus packet, session, web, and email reconstruction. - **Attack Path Discovery (APD)** — Lateral movement path visualization and choke-point analysis using vulnerability data. - **Integration Hub & Hyperautomation** — Native SOAR workflows with Mandiant, GTI, ePO, Tenable, Splunk, and Nozomi. [**Explore what's new in the Trellix NDR 4.x Release Notes**](/network-and-platform/docs/network-detection-and-response-4-x-release-notes) ### Basics [Trellix NDR 4.x overview](/network-and-platform/docs/product-overview-2) [NDR 4.x key features and capabilities](/network-and-platform/docs/key-features-2) [Select a Trellix NDR software license](/network-and-platform/docs/selecting-a-trellix-ndr-software-license) ### Get started [Get started with Trellix NDR](/network-and-platform/docs/getting-started-with-trellix-ndr) [Manage your NDR licenses](/network-and-platform/docs/license-management) ### Deploy Trellix NDR [Understand and transition your NDR Sensor](/network-and-platform/docs/understanding-your-ndr-sensor-1) [Select NDR Sensor operational modes](/network-and-platform/docs/operational-modes-3) [Plan cluster deployment considerations](/network-and-platform/docs/deployment-considerations) ### Set up user access and security [User management and authentication](/network-and-platform/docs/user-management-and-authentication) [Configure SAML authentication](/network-and-platform/docs/configuring-saml-authentication) ### Configure Trellix NDR [Perform initial appliance configuration](/network-and-platform/docs/initial-configuration-4) [Configure appliance and network settings](/network-and-platform/docs/appliance-configuration) [Configure clusters and distributed search](/network-and-platform/docs/clusters-and-distributed-search) ### Integrate Trellix NDR [Supported integrations overview](/network-and-platform/docs/supported-integrations) [Configure SIEM, Tenable, and ePO integrations](/network-and-platform/docs/configure-integrated-products) [Integrate NX and NDR Sensor appliances](/network-and-platform/docs/integrating-an-nx-ndr-sensor-appliance-with-ndr) [Configure Nozomi Guardian (OT/IoT)](/network-and-platform/docs/configure-nozomi-guardian-using-the-web-ui) ### Investigate alerts [Investigate alerts using Trellix Wise™](/network-and-platform/docs/investigating-alerts-using-trellix-wise) [View alert details and MITRE ATT&CK mapping](/network-and-platform/docs/viewing-the-details-of-the-alert) [Analyze Mandiant Threat Intelligence alerts](/network-and-platform/docs/threat-intel-alerts) ### Hunt for threats and manage risk [Investigate threats and Attack Path Discovery](/network-and-platform/docs/investigate-threats-and-manage-risks) [Detect anomalies using Docker plugins](/network-and-platform/docs/anomaly-detections-using-docker-plugins) [Manage alert policy exceptions](/network-and-platform/docs/manage-alert-policy-exceptions) ### Monitor appliance health [Analyze and manage dashboards](/network-and-platform/docs/managing-dashboards) [System administration and upgrades](/network-and-platform/docs/system-administration) [Configure SNMP monitoring](/network-and-platform/docs/snmp-configuration) ### Trellix NDR Product Documents [Release Notes](/network-and-platform/docs/network-detection-and-response-4-x-release-notes) [Product Guide](/network-and-platform/docs/network-detection-and-response-product-guide-4-x) [API Reference Guide](/network-and-platform/docs/network-detection-and-response-api-reference-guide-4-x) [Deployment Guide](/network-and-platform/docs/network-detection-and-response-console-deployment-guide-4-x) ### Demos, Tours & Solution Resources [Trellix NDR Solution Brief (PDF)](https://www.trellix.com/assets/solution-briefs/trellix-network-detection-and-response-solution-brief.pdf) [Interactive Product Tour: Take the NDR Tour](https://www.trellix.com/products/network-detection-and-response/) [Video: Trellix NDR 4.0 Overview & Demo](https://www.youtube.com/watch?v=OAfLTbY7TKs) [Video: Trellix NDR with GenAI in Action](https://www.youtube.com/watch?v=u1Oya135pjo) [Blog: 5 Ways Trellix NDR Advances the SOC](https://www.trellix.com/blogs/platform/5-ways-trellix-ndr-4-1-advances-the-soc/) ### Support & Knowledge Base [Best practices to deploy Trellix NDR Console (000015495)](https://support.trellix.com/s/article/000015495) [Quick Reference: Trellix appliance upgrade paths (000001604)](https://support.trellix.com/s/article/000001604) [Virtual and Cloud Image Delivery Guides](https://support.trellix.com/s/article/000002946) - [000002946 (Virtual Appliances)](https://support.trellix.com/s/article/000002946) - [000002886 (Cloud Image Delivery)](https://support.trellix.com/s/article/000002886)