NDR Shouldn't Be Another Silo

An NDR solution should not become yet another isolated system within your security infrastructure.

The value of a solution like Vectra significantly increases when it integrates with the organizational ecosystem in two key directions: receiving information and context from existing systems, and relaying its findings to investigation and response systems.

Integrations can be broadly categorized into several key layers:

Cloud

Connecting to AWS, Azure, and Google Cloud expands visibility into cloud and hybrid environments.

SIEM

Transferring detections, risk scores, and network metadata allows analysts to correlate findings with additional data sources.

SOAR and ITSM

Activating playbooks, opening incidents, attributing findings to the relevant entity, and managing the response process.

Endpoint

Integrating information from EDR solutions enables correlation between network behavior and users, processes, and endpoint activity.

Firewall

Transmitting findings to enforcement systems allows for blocking communication or isolating assets according to organizational policy.

Traffic Visibility

Packet brokers and network visibility solutions feed traffic from various network segments to Vectra, improving coverage and reducing blind spots.

Infrastructure

Connecting to virtualization environments and data center infrastructures expands visibility into assets and communication within the organizational environment.

However, the mere existence of an integration does not necessarily generate value.

The crucial questions are: what information is transferred, how does it improve context, and what action is taken as a result?

For us at Danet, a successful ecosystem is one that streamlines the workflow:

• Traffic collection
• Detection and prioritization
• Finding enrichment
• Investigation
• Response and enforcement