Protoxol
Request a demo
Platform Modules Plans Blog Request a demo
NDR · Module

Network Detection & response

Protocol-aware inspection. Beaconing detection. Lateral movement.

Compare with 5 alternatives ↓

Overview

What NDR does.

Network Detection and Response captures flow and packet metadata from your VPCs, on-prem switches and remote sites. Protoxol NDR ships software sensors (no appliances) that parse over 60 protocols deep — DNS, HTTP, SSH, RDP, SMB, Kerberos and more — and write to the same event bus as EDR. Result: an analyst sees a process spawn on a host and the outbound C2 beacon as two rows of the same timeline.

Features

Inside NDR.

Protocol-aware inspection

60+ protocols parsed at line rate. Zeek-grade detail without Zeek operations.

Beaconing detection

Statistical jitter analysis identifies C2 beacons even with random sleep.

Encrypted traffic analysis

JA3/JA4 fingerprinting, certificate metadata, SNI analysis — without decryption.

Cloud-native sensors

Run as DaemonSet on Kubernetes, sidecar on ECS, or VPC mirror tap on AWS/Azure/GCP.

Lateral movement detection

Cross-host graph analytics catch east-west attacks invisible to perimeter tools.

Use cases

Where NDR earns its keep.

C2 beacon discovery

Find dwelling threats via long-tail outbound patterns, not signature matches.

Unmanaged device discovery

Inventory every IP that talks on the network — IoT, OT, contractor laptops, shadow VMs.

Data exfiltration

DNS tunneling, abnormal volume to new destinations, suspicious upload bursts.

Technical specs

NDR under the hood.

Throughput 10 Gbps per sensor instance
Deployment Container, VM mirror, VPC tap
Encryption support TLS 1.2/1.3 metadata + JA3/JA4
Retention Flows: 1 year, Packets: 7 days

Figures from internal testing; test method and date to be published.

Compare alternatives

Protoxol NDR compared with five alternatives

An EDR does not see unmanaged devices, traffic between servers or an outbound connection that repeats every few minutes. Protoxol's NDR module covers that gap with software sensors that read flow and packet metadata, detect beaconing and lateral movement, and write to the same event bus as the EDR. This comparison sets Protoxol NDR against five relevant alternatives and says where each one fits better.

What Protoxol offers

Comparison table

Each cell shows the status and the scope. Statuses are explained below the table.

Show alternative:

Scroll the table sideways to see every column.

Protoxol NDR compared with five alternatives
CriterionProtoxol NDRVectra AI Platform, NDR scope (Detect for Network)Darktrace / NETWORK (shown on the vendor site as / HYBRID NETWORK)ExtraHop RevealX 360 (NDR module)Cisco Secure Network Analytics (formerly Stealthwatch)Corelight Open NDR Platform with Investigator
Data sources AvailableSoftware sensors read flow and packet metadata from VPCs, switches and remote sites; it also ingests Zeek and Suricata data you already run. AvailablePhysical or virtual sensors capture traffic (SPAN, TAP, cloud mirroring) and send metadata to a Brain; it adds identity observed in Kerberos, LDAP and NTLM. ↗ AvailableRaw traffic through an appliance port, vSensor or osSensor; it accepts syslog and telemetry from other tools with extra configuration. ↗ AvailablePhysical, virtual, container or hyperscaler sensors, with a SaaS or on-premises edition. NDR, NPM, IDS and Packet Forensics modules share the platform. ↗ AvailableFlow Collector ingests NetFlow, IPFIX, NVM and syslog from routers, switches, firewalls and endpoints; the optional Flow Sensor adds layer 7. ↗ AvailablePassive sensors produce Zeek metadata and Suricata alerts, with YARA file analysis and Smart PCAP; Investigator works on that output. ↗
East-west and lateral movement AvailableThe module page describes cross-host graph analytics for east-west attacks. There is no published detection-rate data or measured case. AvailableDetects lateral movement in east-west traffic and outbound communication. It advises against capturing outside the edge firewall, where inbound traffic dominates. ↗ AvailableIts site says it detects lateral movement by correlating network, cloud, identity and OT. It needs complete, bidirectional traffic without duplicates. ↗ AvailableIts site highlights exposing encrypted threats that move laterally. The pages read give no detection-rate data. ↗ AvailableAlarms for lateral movement, data hoarding and exfiltration, computed on flow telemetry. ↗ AvailableInvestigator reviews seven days of host activity to find persistent patterns and lateral movement. ↗
Detection approach AvailableStatistical jitter analysis for beaconing, plus inspection rules you can edit and version in Git. It does not describe per-device behavioural baselining. AvailableIts own AI (Attack Signal Intelligence) prioritises entities; triage learns the environment and suppresses detections of authorised behaviour. ↗ AvailableBehavioural profile per device and its peers using unsupervised learning; alerts from models and Cyber AI Analyst incidents. ↗ AvailableExtraHop runs the machine learning in the cloud; IDS detection is a separate module within the platform. ↗ AvailableBehavioural modelling, multilayered machine learning and global threat intelligence, without relying on signatures. ↗ AvailableMulti-layered approach combining machine learning, behavioural analytics, curated signatures and threat intelligence. ↗
Encrypted traffic AvailableJA3/JA4 fingerprints, certificate metadata and SNI analysis without decryption. TLS decryption to inspect content is not listed as a feature. AvailableMost detections work without decryption. For Match or Stream, decrypted traffic can be added through a parallel pipeline. ↗ AvailableIts site says it analyses encrypted and decrypted traffic. The pages read do not detail what it extracts without decryption. ↗ AvailableThe sensor decrypts TLS 1.3 with PFS at line rate per its 2022 datasheet; it adds JA4+ fingerprints. ↗ Depends on setupAnalyses encrypted traffic without decrypting; the optional Flow Sensor (since 7.1) generates the extended ETA telemetry. ↗ AvailableIncludes a detection collection for encrypted traffic. The pages read do not say whether it uses metadata or decryption. ↗
Investigation and evidence retention Depends on setupNetwork and host events in one timeline, enriched with Threat Intel IOCs. Flow and packet retention depends on the plan; PCAP download is not described. Depends on setupDetections with micro-PCAPs are generally kept six months; metadata depends on the contracted option or on your own data lake. ↗ Depends on setupDPI metadata and per-device activity in Advanced Search, around 30 days in most deployments; exportable to keep more. ↗ Depends on licenceCloud record store with 90 days in the 2022 datasheet, extendable in bands; continuous packet capture on Ultra sensors. ↗ Depends on setupThe optional Data Store centralises flows with one to two years of retention, per the datasheet. ↗ AvailableZeek metadata for long lookback and Smart PCAP for packets of sessions of interest. Retention periods not published. ↗
Response actions Depends on licenceBlocking an IP is an action of the response automation module (Enterprise plan), with human approval by default. The blocking mechanism is not described. Needs integrationHost lockdown through EDR and account lockdown in Entra ID; SOAR through API. The third-party tool carries out the action. ↗ AvailableNative autonomous response: cuts connections with TCP RST or limits connectivity; extendable through firewalls and EDR. Models can force human confirmation. ↗ Needs integrationResponse relies on integrations, CrowdStrike among them. The pages read do not describe native blocking. ↗ Needs another productANC network-access policies are defined in SNA but carried out by Cisco ISE; without ISE there is no such action. ↗ Needs integrationFrom the case: isolate a host with CrowdStrike, block on Palo Alto Networks, log out in Entra ID. They depend on those products. ↗
Deployment requirements AvailableSoftware sensors as container, VM mirror or VPC tap, no appliances; one sensor per segment with NDR enabled and outbound 443 to the platform. Depends on setupNeeds at least one Brain (physical or virtual) with paired sensors; small deployments can use a single mixed-mode appliance. ↗ Depends on setupPhysical appliance, virtual vSensor or host osSensor, with a Master. Keeping the traffic mirror complete is the customer's responsibility. ↗ Depends on setupSaaS with a cloud control plane and your own sensors, or a self-hosted on-premises edition. Sensors are physical or virtual. ↗ Depends on setupManager (hardware or VM) and Flow Collector with a flow licence; Flow Sensor, Data Store and Telemetry Broker are optional. ↗ Depends on setupPhysical appliances, virtual, cloud and software sensors, and flow-log sensors. Investigator is SaaS. ↗
Cloud and Kubernetes AvailableDaemonSet on Kubernetes, sidecar on ECS and VPC mirror tap on AWS, Azure and GCP, per the module page. No independent validation published. Depends on setupNative traffic mirroring on AWS, GCP and Azure. Kubernetes does not appear in the pages read. ↗ AvailableAutoscaling vSensor in cloud, AWS and GCP mirroring, and a containerised osSensor for Kubernetes and AWS Fargate. ↗ AvailableIn 2026 it added Kubernetes visibility, with mTLS decryption between services; agentless cloud mirroring is in its 2022 datasheet. ↗ Needs another productTelemetry Broker reads AWS VPC and Azure NSG flow logs; full public-cloud coverage is Secure Cloud Analytics (SaaS). Kubernetes is not listed. ↗ Depends on setupCloud sensors for AWS, Azure and GCP. Kubernetes is not detailed in the pages read. ↗
Link to endpoint signals AvailableNDR and EDR signals from the same asset are grouped into one incident. You also need the EDR module active to see the host side. Needs integrationIntegrates with CrowdStrike Falcon, Microsoft Defender and SentinelOne; it does not replace the EDR. ↗ Needs integrationIt recommends integrating third-party EDR and firewalls to extend actions; the osSensor forwards host traffic and is not an EDR. ↗ Needs integrationSince 2026 it integrates Microsoft Defender for XDR to cross signals; the network sensor does not act as an EDR. ↗ Needs integrationIngests NVM endpoint telemetry; since 7.5.1 it counts toward the flow rate. It is not an EDR. ↗ Needs integrationThreat intelligence through CrowdStrike and host isolation with its EDR; no agent of its own on the hosts is listed. ↗
Licensing model Depends on licenceNDR is in Team and Enterprise, not Starter, and switches on per module. Pricing follows endpoints and mailboxes, not users or ingest. Not confirmedThe pages read do not publish the licensing model or prices. Ask Vectra. Depends on licenceSubscription by usage-metric bands set in the order form. Price not published. ↗ Depends on licenceNDR, NPM, IDS and Packet Forensics modules are separate in Enterprise and 360. Price not published. ↗ Depends on licenceFlow Rate licence by flows per second, with one-, three- and five-year subscriptions. ↗ Not confirmedThe pages read do not publish licensing or prices. Ask Corelight.

What each status means

Available
Native feature of the product or plan compared.
Needs integration
Works through a connector or a third-party product.
Depends on setup
Exists, but its scope depends on deployment or configuration.
Depends on licence
Only in a higher plan or as a paid add-on.
Needs another product
Covered by a different product from the same vendor.
In development
Announced or being built; not generally available.
Not confirmed
Not enough evidence. It does not mean “no”.

Five comparisons

One per product, naming the plan that was compared.

Vectra AI Platform, NDR scope (Detect for Network)

Plan or edition: Network detection and response with network sensors and Brain; identity, cloud and SaaS modules not compared; licence terms not public

Vectra AI Platform, at its NDR scope, is built on sensors plus a Brain and aims to cut noise: triage learns which behaviour is authorised and the console ranks entities by priority. It also reads identity from Kerberos, LDAP and NTLM. Protoxol NDR does not describe prioritisation of that kind; its difference is that the beacon and the host process land in one timeline and that inspection rules are editable and versioned. Vectra fits if your SOC already handles high network volume and wants it ordered; Protoxol fits if you want NDR next to EDR. Limit: the Brain is mandatory, so size it in the design.

Official source ↗

Darktrace / NETWORK (shown on the vendor site as / HYBRID NETWORK)

Plan or edition: Real-Time Detection plus Autonomous Response, sold by usage-metric bands in the order form; Darktrace / EMAIL not included

Darktrace builds a pattern of life per device and per peer group, and that baseline drives its alerts and, if you enable it, autonomous response that cuts connections. Network response ships inside the product itself. Protoxol NDR does not offer autonomous containment; blocking goes through the automation module, with human approval by default. Who it suits: if you want the network to contain threats on its own and accept tuning policies, Darktrace. If you prefer detections traceable to a rule and an analyst who approves, Protoxol. Condition: Darktrace needs a complete, bidirectional traffic mirror; any gap degrades the analysis, per its own specification.

Official source ↗

ExtraHop RevealX 360 (NDR module)

Plan or edition: RevealX 360 (SaaS) with the NDR module; RevealX Enterprise is the self-hosted edition and NPM, IDS and Packet Forensics are separate modules

ExtraHop RevealX 360 puts the weight on the packet: the sensor decrypts TLS at line rate, extracts records and sends them to a cloud record store where you investigate. If your team wants to see inside encrypted sessions, that is a clear advantage over Protoxol, which analyses JA3/JA4, certificates and SNI without decrypting. The trade-off is that response depends on integrations and that record retention grows by buying capacity. ExtraHop fits environments with heavy encrypted internal traffic and a shared network and security team. Protoxol fits if the goal is for NDR, EDR and SIEM to share a console. Condition: the 360 edition sends records to ExtraHop's cloud service.

Official source ↗

Cisco Secure Network Analytics (formerly Stealthwatch)

Plan or edition: On-premises Manager plus Flow Collector with Flow Rate licence; Secure Cloud Analytics (SaaS) and Cisco XDR are separate; current release 7.6.1

Cisco Secure Network Analytics works on flows, not packets: it reuses the NetFlow your routers and switches already emit and turns it into lateral-movement and exfiltration alarms. Its strengths over Protoxol are maturity and long flow retention in the Data Store. The cost is a heavier architecture (Manager, Flow Collector, a flows-per-second licence) and response that goes through ISE or XDR. Who it suits: large Cisco networks with flow export already in place. Protoxol fits better if you lack that estate and want software sensors and NDR next to EDR. Condition: full public-cloud coverage requires Secure Cloud Analytics, which is a different product.

Official source ↗

Corelight Open NDR Platform with Investigator

Plan or edition: Corelight sensors (appliance, virtual, cloud, software) plus Investigator (SaaS); commercial terms not public

Corelight is the natural route if your team already thinks in Zeek: each sensor produces Zeek metadata, Suricata alerts and packets for relevant sessions, and Investigator orders them into cases with response actions. Protoxol describes per-protocol analysis and open rules, but publishes no high-capacity appliance range like Corelight's. If you want network evidence exportable to a SIEM you already run, Corelight fits. If you prefer NDR and EDR in one console, Protoxol. Condition: Corelight's isolation and blocking actions need CrowdStrike, Palo Alto Networks or Entra ID; without them, response is manual.

Official source ↗

When to choose Protoxol

  • You want the host process and the outbound connection in one timeline, because you already use or plan to use Protoxol EDR.
  • You need software sensors as container, VM or VPC tap and do not want to buy appliances.
  • You prefer inspection rules your team can read, edit and version in Git.

When to consider something else

  • You need to see inside TLS sessions: ExtraHop decrypts at the sensor and Protoxol does not describe that.
  • You want automatic network containment without going through another module: Darktrace includes it in its network product.
  • You have a Cisco estate with NetFlow already deployed and need long flow retention: Cisco Secure Network Analytics.
  • Your team already runs Zeek and Suricata or needs high-capacity packet capture: Corelight.

See the module in a demo

Questions about this comparison

01Does Protoxol NDR decrypt TLS traffic?

The module page describes analysis without decryption: JA3/JA4 fingerprints, certificate metadata and SNI. Decryption to inspect content is not listed as a feature; if you need it, ask before you buy.

02Can I use NDR without the EDR?

The module page does not rule it out, but the host-and-network correlation Protoxol describes needs both modules active. Without EDR, network alerts do not cross with host processes.

03What do I need to install?

A software sensor on the segments where you want NDR, with outbound 443 to the platform. Sensors deploy as a container, VM mirror or VPC tap; there is no appliance.

04Can NDR block an IP on its own?

No. IP blocking is an action of the response automation module, included in the Enterprise plan, and by default an analyst approves it before it runs.

05How long does it keep network data?

It depends on the plan: Team and Enterprise have different retention. The exact flow and packet periods on the module page are pending validation, so confirm them with sales.

Sources and review date

Reviewed on October 2, 2026. Reviewed by The Protoxol team.

Protoxol capabilities are based on the current commercial documentation on this site and were not technically validated in this review; anything undocumented is shown as “Not confirmed”. Vendor data comes from each vendor's public documentation on the date shown and may have changed.

Selection

See NDR against your data.

Thirty minutes. Your environment. The modules that fit. No slideware.

Book a demo See pricing