Not its own NDR, but the connection of the one you have
Anyone already running network detection has the detection. What is usually missing is the connection to the management system: an alert has to become an incident, the incident a risk and a measure, and all of it evidenced. The module fetches alerts from Exeon, Darktrace and Vectra every five minutes over the vendor API or accepts them via syslog or webhook. Both paths run through the same parser. Every adopted alert becomes a full SIEM event with OCSF normalisation, enrichment with asset, network zone and location, correlation rules, auto-incident and rule chains.
The cursor stays put on error, the next run fetches the same window again, and the window overlaps so that an alert at the window boundary does not vanish. The duplicates that creates are caught by the duplicate register: every alert becomes an event exactly once.
An NDR alert is mapped onto the existing event types. What cannot be classified becomes an intrusion attempt and not "other", and alerts the platform does not rate at all are always adopted.
On 401 and 403 the connector pauses for 30 minutes immediately, instead of producing failed attempts on an account that belongs to you. Credentials are stored encrypted and never shown again; the base URL and the private-network switch, however, appear in the audit log.
Detection stays with your platform. The incident, the risk and the measure land in the management system, where the evidence is kept.
Schedule a no-obligation demo – we will show you the module with your own use cases.
