Corelight Open NDR
Network detection and response based on Zeek and Suricata.
Logging & Monitoring
Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Addresses 111 stories in our coverage in the last 90 days 3 products that provide it
What it is
Analysis of network traffic to spot lateral movement, command-and-control traffic and data theft, including from devices that cannot run a security agent.
How to value it
Printers, industrial equipment, appliances and unmanaged devices cannot run endpoint protection, and attackers know it. Network detection covers those blind spots, and is often how intrusions that slipped past endpoint tools get caught.
Questions to ask a vendor
- 1How does it handle encrypted traffic?
- 2Does it cover cloud network traffic as well as on-premises?
- 3How many alerts a day should we expect, and how are they prioritised?
- 4Can it work with our endpoint tools and SIEM to respond?
For your risk register
- Risk
- Lateral movement and data theft through devices without endpoint protection.
- Control
- NDR on core network segments and cloud.
- Owner
- Security operations lead.
- Measure
- Share of internal traffic monitored.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Darktrace / NETWORK
Network detection and response based on learning normal behaviour.
Vectra AI Platform
Detection of attacker behaviour across network, identity and cloud.
Recent stories it addresses
420 stories in total- 15 Oct 2026Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spyware
Candiru spyware delivered via zero-click targeted ads to Al Jazeera devices.
- 13 Oct 2026Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
Anthropic warns small AI models could self-replicate across IoT devices within months without centralized
- 13 Oct 2026XWorm RAT Evolves Into Surveillance Platform
XWorm RAT adds surveillance plugins for location, audio, and browser session hijacking.
- 12 Oct 2026Feds Got Warrants to Use Fake Cell Towers to Hunt Down Don Lemon’s Producer
US feds sought warrants to use cell-site simulators on journalists and a political candidate.
- 10 Oct 2026ARTEX AI, Claude agents used in cyberattacks on South Korean banks
Chinese hacker uses ARTEX AI and Claude agents to attack South Korean banks.
- 9 Oct 2026US Disrupts Chinese State-Sponsored Hacking Tools
US disrupts Chinese state-sponsored hacking tools MicroScan and FishHub.
- 8 Oct 2026Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
Russian spies update 'MatchBoil' malware for stealthy attacks on Ukraine.
- 8 Oct 2026ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
ARTEX AI pentesting tool used in data theft attacks on South Korean financial firms
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.