.png?width=265&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Zero Trust illustration")
動作方法： Sophos NDR は、ネットワークの奥深くにあるトラフィックを監視し、疑わしいアクティビティを Sophos Central の Data Lake に送信してさらに分析します。アクティブな脅威や攻撃者が特定された場合、アナリストはすぐに脅威フィードを Sophos Firewall にプッシュして、アクティブな脅威対応を調整し、悪意のあるアクティビティをリアルタイムで自動的に隔離してブロックできます。
マルウェアが検出を回避するために使用する動的ドメイン生成テクノロジーを特定します。
強力なロジックエンジンは、セッションベースのリスク要因に基づいた警告を送信するルールを活用します。
Network Detection and Response (NDR) gives you clear visibility into what is happening across your network. It continuously monitors network traffic and flags suspicious or malicious activity, including threats that can slip past endpoints or perimeter controls. NDR passively inspects traffic using five detection engines (with some analytics running on a schedule for deeper correlation) and sends actionable detections into Sophos Central so your team can investigate and respond quickly.
NDR reveals what is happening inside your network (east-west traffic) as well as traffic entering or leaving it (north-south traffic). This level of visibility helps you detect suspicious activity between devices, command-and-control (C2) behavior, and unusual data movement. It strengthens your defenses across the entire attack surface, not only at the perimeter.
Each tool plays a different role:
Sophos NDR complements these tools by adding AI-powered network analytics and delivering high-value detections directly into Sophos Central to support extended detection and response (XDR) and managed detection and response (MDR) workflows.
Some threats hide in network behavior rather than leaving clear traces on endpoints. NDR helps uncover activity such as lateral movement, malware command-and-control (including zero-day C2 patterns), rogue or unmanaged devices, insider-driven data movement, and suspicious encrypted traffic behavior. By focusing on network activity, NDR brings these blind spots into view.
NDR blends deep learning, behavioral analytics, and rule-based logic across multiple detection engines. It correlates evidence and applies clustering and scoring before generating detections. This approach cuts down on noise, improves accuracy, and helps identify unknown or encrypted threats without overwhelming the team.
NDR analyzes network flows created from packet data and enriches them with protocol details, traffic behavior, TLS attributes, and other risk indicators. Deployment is simple: A passive sensor connects to a SPAN or mirror port, providing broad visibility without adding latency, disrupting operations, or introducing an inline point of failure.
NDR is flexible. You can deploy it as a virtual appliance on VMware or Hyper-V, run it in AWS, or use certified hardware. Sensors monitor important network segments, and detections flow into Sophos Central for a unified view across on-premises and cloud environments.
NDR detections feed into Sophos Central, where analysts can investigate, correlate telemetry, and act. Integrated workflows can also push threat intelligence to other Sophos products. For example, analysts can push a threat feed to Sophos Firewall to trigger Active Threat Response, automatically isolating a compromised host and blocking related malicious communications to contain threats faster.
A strong NDR solution should offer multiple detection techniques, AI-based encrypted traffic analysis, high-value detections supported by scoring, flexible deployment choices, and smooth integration with XDR or MDR programs. The right solution should close visibility gaps and improve response times without adding operational complexity.
Sophos NDR is licensed based on users and servers, with the virtual appliance included in the subscription. Organizations justify ROI by closing visibility gaps, reducing dwell time, improving analyst efficiency with high-value detections, and speeding containment through automated response workflows, helping prevent costly incidents while increasing the impact of existing security investments.
Sophos Central は、警告、レポート、管理をリアルタイムで行うための単一のダッシュボードです。
.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
