Network & Infrastructure Security
Open NDR Platform
Open, Zeek-based NDR turning raw network traffic into structured forensic evidence.
Open NDR Platform Overview
What it does
Open NDR Platform is a Network Detection and Response (NDR) platform built on the open-source Zeek monitoring engine, generating structured forensic evidence from raw network traffic instead of relying on opaque, black-box alerts. It combines Zeek network security monitoring, Suricata intrusion-detection signatures, YARA file analysis, and transparent AI and machine-learning detections, so analysts see inspectable evidence and detection logic rather than an unexplained verdict. The open architecture avoids proprietary lock-in and interoperates with a customer's existing security stack.
How it works
Sensors deploy as physical appliances, virtual machines, cloud sensors across AWS, Azure, and GCP, or flow-log sensors, tapping traffic out of band and transforming it into structured Zeek logs, Suricata intrusion-detection alerts, YARA file detections, and Smart PCAP capture for retrospective forensics. Fleet Manager orchestrates machine-learning detection collections across the sensor fleet, while the Investigator module adds agentic triage and natural-language investigation that correlates related detections into incident timelines. Pre-correlated evidence and prioritized alerts feed native integrations with CrowdStrike Falcon, Microsoft Sentinel, and Splunk across Security Information and Event Management (SIEM), Extended Detection and Response (XDR), and orchestration platforms.
Credentials and traction
Named a Leader in the inaugural 2025 Gartner Magic Quadrant for Network Detection and Response and in The Forrester Wave: Network Analysis and Visibility Solutions, Q4 2025. The platform has reached FedRAMP Moderate In Process status on the FedRAMP Marketplace. Built on Zeek, the open-source network security monitoring standard created by co-founder Vern Paxson, it gives buyers inspectable, non-proprietary detection logic, and protects government agencies and large regulated enterprises across financial services, energy, healthcare, and transportation.
Key Capabilities
mapped to solution categoriesPerforms retroactive and forensic analysis using network flow data and scalable full-packet capture with long-term retention.
Includes traditional detection such as IDPS signatures, rule-based heuristics and threshold alerts alongside behavioral analytics.
Performs deep packet inspection on industrial protocols (Modbus, DNP3, EtherNet/IP, PROFINET, IEC 61850, OPC-UA), for behavioral monitoring of OT environments alongside IT network analysis.
Uses an AI-based search assistant to accelerate threat hunting and surface actionable insights.
Groups related network alerts into structured incidents that reconstruct an attack across hosts and time, reducing alert volume and giving analysts a single investigation timeline instead of disconnected events.
Detects threats using intelligence feeds from internal and external sources.
Detects threats in TLS-encrypted traffic using JA3/JA3S fingerprinting, certificate anomaly detection, and traffic behavioral analysis, without requiring decryption.
Monitors lateral movement traffic between internal network segments and hosts, distinct from perimeter monitoring. Requires network tap or span port placement on internal switch infrastructure.
Builds per-device and per-application baselines of normal network communication patterns and detects deviations, enabling detection of novel C2 channels, data staging, and lateral movement.
Extends network detection to cloud VPC traffic using VPC flow log analysis, cloud-native sensors, or mirroring, covering east-west traffic between cloud workloads.
Compliance
certificationsIntegrations
compatible toolsImplementation & support
Info last updated on August 10, 2026
Buyers
See how Open NDR Platform fits your stack
Add Open NDR Platform to your shortlist and unlock all evaluation tools.
Vendors
Is this your product?
Claim your profile to connect with the teams looking for your solutions.