Network Detection & Response (NDR) platforms analyze network traffic — via mirrored flows, packet capture, or cloud VPC flow logs — to detect adversary behavior that evades endpoint and identity-layer controls. Core capabilities include behavioral baselining, lateral movement detection, command-and-control (C2) identification, encrypted traffic analysis without decryption, deep forensics retrieval from stored packet history, and investigation workflows that pivot from network evidence into endpoint and identity context. NDR is the network pillar of the SOC's detection triad (endpoint, identity, network), covering the traffic that unmanaged devices (OT, IoT, BYOD) generate and the east-west movement perimeter tools cannot see. Leading vendors include Darktrace, ExtraHop, Vectra AI, Corelight, Arista Awake, and Cisco Secure Network Analytics.