In order to use an NDR tool, the infrastructure must provide a way to analyze network communications. This can be done, for example, by a switch SPAN port or a dedicated Test Access Point (TAP).
It is also necessary to specify which network traffic is to be analyzed. Typically, a first point of analysis is the network interface between their organization and the public network. Here they have the possibility to analyze all accesses from their network. In addition, the transitions between individual network segments within their organization can be monitored, e.g. to identify lateral movement activities.
In addition, SECUINFRA needs secure access to their network environment to keep their NDR tools up to date.