Organizations can benefit from a holistic approach to threat detection and response and faster ways to correlate an ever-growing volume and variety of data. The deeper the visibility and context, the more precise the investigation into threat activity. That means when security telemetry can come together, it paints a more accurate picture of the entire attack path.
As an add-on to Sophos MDR, the Sophos Network Detection and Response (NDR) virtual appliance monitors network traffic to identify suspicious network flows. Detections are sent to the Sophos data lake, evaluated, and assigned a corresponding risk score, generating cases for the Sophos threat response team to investigate and validate. NDR detections can trigger an investigation into internal host connections to network servers and can also be used to enrich threat hunts for endpoint activity to determine which devices are communicating.