presentation for beginers

1. Trellix NDR
Created by: Hasnain Ishtiaq

2. Introduction
 What is NDR (Network Detection and Response)
NDR is a cybersecurity approach that focuses on identifying and responding to
threats within a network by continuously monitoring and analyzing network
traffic.
 It provides visibility into internal and external communications to identify
suspicious or malicious behavior that other tools (like EDR or SIEM) might
miss.

3. Trellix NDR
 It is a solution that focuses on identifying
and responding to threats within a network
by continuously monitoring and analyzing
network traffic.
 It provides real-time visibility into internal
and external network traffic to detect
suspicious activity that might not be
visible from endpoint or log-based tools.

4. Benefits of Trellix NDR
 Detects threats missed by endpoint or log-based tools
 Enhances Zero Trust architectures with deep visibility
 Reduces mean time to detect (MTTD) and respond (MTTR)
 Strengthens SOC capability with contextual network intelligence

5. Main Components
Here are the main components of Trellix NDR
 Traffic Capture & Inspection
 Deep Packet Analysis
 Behavioral & Signature-Based Detection
 Threat Intelligence Integration
 Alerting, Correlation & Response

6. Traffic Capture & Inspection
 Passive sensors are deployed across strategic network points (e.g., SPAN
ports, TAPs).
 NDR captures full packet data (PCAP) and metadata (NetFlow/IPFIX) in real
time.
 It inspects:
1. DNS, HTTP/S, FTP, SMTP traffic
2. Encrypted traffic via TLS fingerprinting
3. Payloads for file reconstruction and analysis

7. Deep Packet Analysis
 Performs Layer 7 analysis (application layer) to understand true behavior
behind sessions.
 Extracts artifacts such as:
1. File hashes
2. Command-and-control patterns
3. Lateral movement attempts
4. Anomalous user behavior

8. Behavioral & Signature-Based Detection
Combines:
1. Static signatures for known threats (Trellix Threat Labs intelligence)
2. Behavioral analytics to detect novel or zero-day threats
3. AI/ML models to baseline normal traffic and flag anomalies

9. Threat Intelligence Integration
 Enriched with Trellix Global Threat Intelligence (GTI) and Mandiant legacy
feeds.
 Detects:
1. Known malicious IPs/domains
2. Suspicious payloads
3. Threat actor TTPs (MITRE ATT&CK mapping)

10. Alerting, Correlation & Response
 Generates detailed alerts with context (host, user, protocol, file, timestamp).
 Integrates with Trellix XDR and EDR to correlate network findings with
endpoint behaviors.
 Supports:
1. Automated playbooks
2. Threat hunting
3. Incident triage and investigation

11. Summary
Trellix NDR enhances visibility into network-layer threats that may go
undetected by endpoint or email tools alone. With AI-powered analytics,
full packet capture, and deep integration across the Trellix XDR
platform, it enables a proactive, intelligence-driven defense strategy.

12. Thank you