A security architect is evaluating whether to deploy a Network Detection and Response (NDR) solution or expand SIEM capabilities for east-west traffic monitoring in a data center. Which capability uniquely favors the NDR approach?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because NDR analyzes raw packet/flow data from the network itself, which a compromised host cannot tamper with — unlike host-generated logs that malware may delete or manipulate. NDR's ML-based behavioral models also detect encrypted malicious traffic by analyzing flow metadata rather than payload content.
Full explanation below image
Full Explanation
B is correct because NDR analyzes raw packet/flow data from the network itself, which a compromised host cannot tamper with — unlike host-generated logs that malware may delete or manipulate. NDR's ML-based behavioral models also detect encrypted malicious traffic by analyzing flow metadata rather than payload content. A is wrong because SIEM excels at log aggregation and correlation; this is a SIEM strength, not NDR's. C is wrong because compliance reporting is a SIEM/GRC function. D is wrong because ticketing/workflow integration is a SOAR capability commonly added to both platforms.