Network detection and responseEncrypted traffic analytics

Detect Attackers Already Inside the Network, Even in Encrypted Traffic

Learn MoreBook a Demo

Customer problem

Attackers Can Operate Inside Trusted Networks

Internal networks were built on trust. A device on the office LAN or in the data centre is often treated as safe because of where it sits.

After initial access, attackers look around, try harvested credentials and move from machine to machine using normal protocols. To a perimeter device, this traffic never crosses the perimeter.

Most traffic is encrypted, and teams cannot review east-west traffic by hand.

  • Device-to-device traffic perimeter tools never see
  • Encrypted sessions that hide malicious activity
  • Decryption that is costly or not always allowed
  • East-west volume too high to review by hand
  • Servers and equipment that cannot run an agent
  • Attackers staying unnoticed in a healthy-looking network

THE COSGRID SOLUTION

See Inside the Network Without Decrypting

NetShield NDR is designed to watch traffic inside your network and flag behaviour that does not fit. It analyses connection metadata, such as handshake details and flow patterns, without decrypting content, so your team can investigate sooner.

With NetShield NDR, organisations can

  1. Analyse internal and east-west traffic
  2. Read encrypted-traffic metadata without decrypting it
  3. Flag activity that looks unusual for a device or segment
  4. Observe devices that cannot run an agent
  5. Send findings to SIEM and SOAR tools

How It Works

  1. Place Sensors

    Network sensors sit where they can see internal traffic, such as a data-centre core or a branch network.

  2. Analyse Traffic and Metadata

    Flows and encrypted-traffic metadata, such as TLS handshake details, are analysed without decrypting content.

  3. Flag Unusual Behaviour

    The system is designed to learn normal traffic and flag departures from it, for analyst review.

  4. Send Findings Onward

    Findings go to your SIEM and SOAR tools, so analysts can review them alongside endpoint, identity and firewall events.

Key Benefits

Internal Visibility

See traffic that perimeter tools never see, including east-west and server-to-server flows.

Encrypted Traffic Signals

Get signals from encrypted sessions while content stays private. No decryption infrastructure is needed.

Anomaly Detection

Designed to surface activity that matches no known signature.

Agentless Coverage

Observe servers, appliances and connected devices that cannot run an endpoint agent.

Multi-Site View

Designed to link related findings across branches and data centres.

Fits Your Workflow

Network detections can sit alongside other alerts in your SIEM and SOAR tools.

Traditional Perimeter Monitoring vs NetShield NDR

Traditional Perimeter Monitoring

  • Watches traffic crossing the network edge
  • Relies mainly on signatures and blocklists
  • Needs decryption to inspect encrypted content
  • Sees little server-to-server traffic
  • Covers devices that pass through it
  • Reviews each site separately

NetShield NDR

  • Designed to watch traffic inside the network, including east-west
  • Adds behaviour and anomaly analysis
  • Analyses handshake and flow metadata without decryption
  • Can observe server-to-server traffic where sensors are placed
  • Can observe devices that cannot run an agent
  • Designed to correlate findings across sites

Use cases

Built for every access scenario

Detect internal reconnaissance activity

Detect internal reconnaissance activity

A compromised laptop starts probing many internal hosts and ports. NetShield NDR can flag the pattern for investigation.

Identify unusual server-to-server activity

Identify unusual server-to-server activity

A server that normally talks only to a database begins opening remote-administration sessions to other servers. NetShield NDR can flag the change.

Spot unusual encrypted connections

Spot unusual encrypted connections

A device opens a TLS session with a handshake fingerprint unlike the browsers and apps normally seen on that segment. It can be flagged without decrypting the session.

Detect unexpected data movement

Detect unexpected data movement

A file server suddenly sends a large volume of data to an unfamiliar external address. NetShield NDR can flag the flow for review.

Who Is This For

Want to limit what an attacker can reach first? See "Stop one compromised device from spreading through the network"

  • SOC Teams
  • CISOs
  • Incident Response Teams
  • Security Operations Leads
  • Multi-Site Organisations

FAQs

Have a question about NetShield NDR and network detection?

questionWhat is network detection and response (NDR)?
arrow
NDR is a category of security tool that analyses network traffic to find suspicious activity. Unlike perimeter tools, it watches traffic inside the network, including traffic between internal devices and servers.
questionDoes NetShield NDR decrypt encrypted traffic?
arrow
No. NetShield NDR is designed to analyse encrypted traffic using metadata that is visible without decryption, such as TLS handshake details, flow records and packet size and timing patterns. The content of encrypted sessions is not read.
questionCan metadata alone detect threats in encrypted traffic?
arrow
It can surface signals that a connection looks unusual, such as an unfamiliar client fingerprint or a beaconing pattern. It cannot show what was sent inside the session. Findings should be treated as leads for investigation.