Sophos Network
Detection and Response
A Powerful Addition to Sophos XDR and Sophos MDR
Sophos NDR works together with your managed endpoints and firewalls tomonitor network activity for suspicious and malicious patterns solutions cannot
see. Sophos NDR detects abnormal traffic flows from unmanaged systems andIoT devices, rogue assets, insider threats, previously unseen zero-day attacks,and unusual patterns deep within the network.

Sophos NDR Provides Critical Visibility Into Network
Activity That Other Products Miss
Attackers are skilled at evading detection, but every attack needs to move around anetwork. Sophos NDR detects suspicious network traffic patterns that go unseen by yourmanaged endpoints and firewalls, including:Ì Unknown or Unprotected Network Devices – including legitimate IoT or OT devices
that cannot be fully managed with an endpoint sensor, as well as unknown orunidentified systems on the network. These devices may be compromised or
become compromised as part of an attack. Sophos NDR identifies and monitorsthese devices for suspicious or malicious behavior that might signal an attack.
Ì Unauthorized or Rogue Assets – that are brought onto the networkthat may already be compromised or used to launch an attack
can be readily identified and monitored by Sophos NDR.
Ì New and Previously Unseen Command and Control (C2) Activity – manyattacks or breaches are orchestrated remotely using what looks likelegitimate communications between a bad actor and their remote processes
inside the network. Sophos NDR can detect new zero-day C2 activity toidentify a bespoke, targeted attack that may be just getting started.
Ì Suspicious or Malicious Network Traffic Flows and Patterns – can be importantsignals in the early identification of a cyberattack. Indications can include unusual
off-hours network activity or remote access, suspicious data uploads or exfiltration,
abnormal traffic patterns, and malicious traffic generated by known malware.

NDR Works With Your Firewall
Firewalls play a critical role in securing your network perimeter and controlling whatcomes and goes. Sophos NDR is the perfect complement to your firewall solution, as
they work together to provide insights and coverage deep inside the network where yourfirewall lacks visibility. It also includes technologies that uniquely identify suspicious andmalicious activity traversing your internal network that can’t otherwise be detected byany firewall or endpoint protection product.

Highlights
Ì The perfect addition to Sophos
XDR and MDR, providing
detections deep within anetwork
Ì Works with your firewall todetect network activity andthreatsÌ Detects suspicious network
activity originating fromunknown or unmanaged
devices, rogue assets, andzero-day C2 servers
Ì Inspects encrypted
traffic flows withoutcompromising PII
Ì Deploy, configure, andmanage from Sophos Central

Sophos Network Detection and Response

Sophos NDR Operates Deep Within Your Network to Detect an Attack
InternetThe threat feed is sent to Sophos Firewall(feature requires Sophos Firewall)

Sophos Firewall actively responds,
blocking the threat and related traffic
OUTSIDE
INSIDE

Sophos Firewall
Managed Endpoints

Sophos orcustomer SOC

Unmanaged Endpoints

SwitchSophos NDR

Access Points

Suspicious activity
detectedServers

IoT Devices

Ì Monitors traffic deep within a network using five real-time engines.
Ì Detects activity from unmanaged systems, IoT devices, rogue users or assets, and all other sources ofnetwork traffic.
Ì Feeds data and alerts to the Sophos Central Data Lake and Sophos’ MDR SOC team or your XDR team.
Ì If you have Sophos Firewall, automated threat response is available to immediately block a threat andprevent lateral movement.
Ì Runs as a virtual appliance on popular hypervisor platforms like VMware and Hyper-V.
Ì Connects directly to your switch via SPAN port mirroring to monitor all traffic.
Ì Inspects encrypted packet data without compromising PII data.

Sophos Network Detection and Response

Sophos NDR Detection Engines
Sophos NDR includes five detection engines that continuously analyze network traffic flows and applying AI
machine learning analysis to identify suspicious and malicious activity deep within your network.
Encrypted Payload Analysis

Deep Packet
Inspection

Domain Generation
Algorithm

Detection Engines

Data Detection EngineSession Risk Analytics

Detection Engines

Description

Encrypted Payload Analytics (EPA)

Detects zero-day C2 servers and new variants of malware families based on patterns found in
the session size, direction, and interarrival times.

Domain Generation Algorithms (DGA)

Identifies the presence of dynamic domain generation technology used by malware to avoiddetection.

Deep Packet Inspection (DPI)

Monitors both encrypted and unencrypted traffic using known IOCs to rapidly identify threat
actors and TTPs.

Session Risk Analytics (SRA)

Powerful logic engine utilizes rules that alert on a multitude of session-based risk factors.

Device Detection Engine (DDE)

Extensible query engine uses a deep learning prediction model to analyze encrypted traffic forpatterns across unrelated network flows.

Sophos NDR Licensing
Sophos NDR is the perfect complement to Sophos XDR and Sophos MDR as an integration package. Sophos
NDR pricing is based on an organization’s total number of users and servers. The virtual appliance softwareis included with the license, and you can deploy as many NDR sensors as needed. This is more affordableand flexible than competing offerings that charge per-instance.

Sophos Network Detection and Response

Sophos NDR Technical Specifications
Supported Platforms
Ì VMware ESXi6.7 and laterÌ Microsoft Hyper-V 6.0.600118016 (Windows Server 2016) or laterÌ Amazon AWS c5n.2xlarge
Ì Certified Hardware
Hardware

Max Throughput

Max Connections/SecCPUs

MemoryDell R660 (2 socket)

40Gbps

120K

64

128GB

Dell R660 (1 socket)

40Gbps

80K

3264GBDell R650

20Gbps

40K

2464GBDell R450

10Gbps

20K

1632GBDell R350

4Gbps

8K

832GB

Intel Nuc 13th Gen

2.5Gbps

4K

1232GBVM System Requirements
Sophos NDR VMs support up to 1Gbps per sensor:
Ì Use Default VM settings for medium traffic volumes:
 Up to 500Mbps
 Up to 70,000 packets/sec
 Up to 1,200 flows/sec
Ì Resize the VM for 8 vCPUs for high-traffic volumes:
 Up to 1Gbps
 Up to 300,000 packets/sec
 Up to 4,500 flows/sec

Additional Resources:Ì Sophos NDR Community ResourcesÌ Enhancing Security Operations with Sophos Network Detection and Response (NDR)
Ì Certified Hardware Specifications

To learn more, visit
sophos.com/ndr

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
24-05-23 DS-EN (PC)

Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com