NDR platforms show their real value during an attack, not during a product demonstration. The key question is whether the platform can help security teams detect suspicious activity and understand how an attacker moved through the environment. If analysts cannot reconstruct that movement or determine which systems communicated with each other, important gaps remain.
This requires visibility into traffic inside the network, not just traffic entering and leaving it. CISA guidance emphasizes monitoring internal traffic to identify lateral movement and command-and-control activity that can occur after an attacker gains access.
When evaluating an NDR platform, look beyond alert accuracy. Consider whether it can monitor east-west traffic, provide adequate coverage across the environment, and establish behavioral baselines that make unusual activity easier to identify.
A simple test can bring these capabilities together: Using only the platform's data, can an analyst determine which systems an attacker accessed, in what order, and what they did? If a platform can generate alerts but cannot help answer those questions, it may add more alerts without making incident response more effective.
East-West Coverage Criteria
East-west coverage determines whether the platform can detect lateral movement after initial compromise. Perimeter-focused solutions create blind spots where attackers operate most extensively — inside the network boundary. The evaluation criterion: does the platform capture communication between internal systems, not just traffic crossing network perimeters?
Coverage architecture shapes detection capability. Agent-based platforms can capture traffic on instrumented hosts but create gaps on unagented systems, embedded devices, and air-gapped segments. Network tap and flow-based platforms can provide broader coverage but may miss encrypted traffic details or high-throughput segment visibility. The tradeoff: comprehensive coverage versus deployment complexity.
Cloud environments complicate east-west visibility. Virtual network traffic can bypass traditional monitoring points, and container-to-container communication often occurs within single hosts where network taps cannot reach. Evaluate how the platform addresses cloud-native traffic patterns — does it integrate with cloud provider flow logs, deploy virtual taps, or require cloud-specific agents?
Test coverage claims in your environment's specific conditions. High-throughput network segments can overwhelm processing capacity, creating intermittent coverage gaps that attackers can exploit. Encrypted traffic reduces payload inspection capability, limiting detection to metadata and flow patterns. Verify coverage claims against your traffic volumes and encryption percentages during proof-of-concept testing.
Detection Quality Criteria
Baseline absence creates the noise-over-signal problem that makes NDR platforms ineffective for investigation. Platforms that rely on static signatures or fixed rules generate alerts for both malicious activity and legitimate operational changes. The evaluation test: how does the platform distinguish legitimate network behavior changes from attacker activity?
Behavioral baseline establishment determines detection accuracy. Effective platforms learn normal communication patterns for each system and alert on deviations that cannot be explained by operational events. The capability requirement: can the platform establish what normal looks like for each host's communication patterns, then detect anomalies within that baseline?
Detection latency affects containment capability. Platforms that require extended learning periods or batch processing cannot support rapid response to active threats. Evaluate detection speed claims against realistic scenarios — how quickly does the platform surface lateral movement after it begins, not just how quickly it processes individual network events.
Alert context quality determines analyst efficiency. Detection alerts without communication history, related events, or pivot capability require analysts to reconstruct context manually. Test whether alerts include sufficient context for immediate investigation — can an analyst determine attack scope from the alert data alone, or do they need additional queries and correlation?
Investigation Support Criteria
Investigation capability separates NDR platforms from basic network monitoring tools. Detection generates alerts; investigation answers questions about attack scope, timeline, and impact. The evaluation criterion: when an alert identifies suspicious activity, can the platform provide the communication history needed to determine what else the attacker accessed?
Communication history depth determines investigation effectiveness. Platforms that only retain recent data or summary statistics cannot support forensic timeline reconstruction. Evaluate retention periods and granularity — can the platform show all connections for a compromised host over the incident timeframe, or only current and recent activity?
Pivot investigation capability enables scope determination. Effective platforms allow analysts to start with one suspicious connection and explore related network activity across systems and time periods. Test pivot functionality during evaluation — from a flagged host, can you identify all other hosts it communicated with, and then investigate those hosts' communication patterns?
Timeline reconstruction requires both granular data and presentation capability. Raw network logs provide evidence but not investigation workflow. Evaluate whether the platform can present network activity chronologically across multiple hosts, showing the sequence of attacker movement through your environment.
Evaluation Criteria Table
| Criterion |
What It Tests |
How to Verify |
Red Flag If Missing |
| East-West Coverage |
Whether platform captures internal traffic, not just perimeter |
Deploy in test environment, generate internal traffic, verify detection |
No visibility into lateral movement scenarios |
| Detection Latency |
How quickly platform surfaces anomalous behavior after it begins |
Time from simulated attack start to alert generation |
Alerts appear hours after activity |
| Baseline Quality |
Whether detection distinguishes attacker behavior from operational noise |
Compare alerts during normal operations versus attack simulation |
High false positive rate during operational changes |
| Investigation Support |
Whether platform provides communication history and pivot capability |
Starting from one alert, attempt to map full attack timeline |
Cannot reconstruct scope from network data |
| Response Integration |
Whether platform connects to SIEM/SOAR with context responders need |
Test alert enrichment and automated response triggers |
Alerts contain only basic metadata |
Response Integration Criteria
Response integration determines whether NDR platforms accelerate incident response or create additional tool overhead. Platforms that operate in isolation require analysts to correlate network evidence with other telemetry sources manually. The integration requirement: does the platform send enriched context to SIEM or SOAR systems, not just alert metadata?
Alert enrichment quality affects response speed. Basic integrations send alert titles and timestamps; effective integrations include communication patterns, affected systems lists, and suggested containment targets. Evaluate integration data quality — do SIEM alerts include sufficient context for immediate response decisions, or do analysts need to access the NDR platform separately for investigation details?
Automated response capability can accelerate containment for high-confidence detections. Platforms that support network isolation, DNS blocking, or firewall rule updates can prevent lateral movement while analysts investigate. The tradeoff: automated containment speed versus false positive risk. Test automated response accuracy carefully — does the platform provide sufficient confidence indicators to support automated actions?
Forensic data export supports investigation beyond platform capabilities. Response teams may need to provide network evidence to external investigators or legal teams. Verify export capabilities during evaluation — can the platform provide network evidence in formats suitable for forensic analysis, not just platform-specific reporting?
Proof of Concept Design
PoC design must simulate active incident conditions, not detection accuracy benchmarks. The scenario framework: simulate initial compromise, conduct lateral movement, and evaluate whether the platform provides evidence needed to detect movement, determine scope, and reconstruct timeline.
Scenario structure creates realistic evaluation conditions. Initial access simulation establishes baseline activity, lateral movement testing validates east-west detection, and scope reconstruction testing verifies investigation capability. Design the PoC to mirror your environment's attack patterns — if attackers typically move between specific system types, test detection for those movement patterns specifically.
Evidence reconstruction serves as the PoC success criterion. The platform passes when an analyst using only network data can answer: what systems did the attacker access, in what order, and what network-visible actions did they perform on each system? Platforms that detect individual events but cannot support timeline reconstruction fail the investigation support requirement.
Timeline validation requires independent verification. PoC scenarios should include known activity that can verify platform accuracy and completeness. Build verification points into your scenario — known file transfers, specific connection patterns, or timed activities that must appear in platform data to validate coverage claims.
Evaluation Questions
Platform evaluation requires demonstration, not marketing responses. Effective evaluation questions force vendors to show capability rather than describe features. Frame questions to distinguish platforms that support investigation from those that only generate alerts.
Coverage verification questions address fundamental capability. Can you demonstrate east-west traffic capture in our cloud environment? How does the platform maintain coverage during network infrastructure changes? What happens to detection capability when traffic volumes exceed processing capacity? These questions reveal coverage limitations that affect investigation support.
Detection quality questions validate baseline and anomaly capability. How does the platform establish normal communication patterns for each host? What distinguishes legitimate application deployment from lateral movement activity? How does detection performance change as the environment learns normal patterns? These questions separate platforms that address baseline absence from those that amplify alert noise.
Investigation support questions test analysis workflow. Starting from this alert, show me all systems this host communicated with in the past week. Can you reconstruct the timeline of network activity across multiple compromised hosts? How do you pivot from network evidence to identify additional affected systems? These questions reveal whether platforms support investigation or merely detection notification.
Sources
