The NDR Sensor is a core component of the NDR solution that provides network visibility, threat detection, and response capabilities. It is essential for monitoring network traffic, identifying malicious activities, and supporting security operations.
Important
Existing customers with physical or virtual appliance on release version 11.0 or later can convert the appliance to NDR Sensor by purchasing and installing an NDR feature license. For list of supported appliance and their minimum supported versions, see Key Licensing Concepts.
The NDR Sensor performs the following functions to provide comprehensive network security:
Monitors network traffic.
Extracts L7 metadata, Indicators of Compromise (IOCs), netflow data, and PCAPs. This extracted data is classified as telemetry and artifacts.
Forwards the collected data to the NDR Console for in-depth analysis.This analysis enables the detection of sophisticated threats and malicious activities, informing subsequent response actions.