Sophos Central Network Detection and Response
82,10 € - 246,29 €
| Quantity | Unit price |
|---|---|
| 3 - 9 | 82,10 € |
| 10 - 24 | 78,00 € |
| 25 - 49 | 73,89 € |
| 50 - 99 | 65,68 € |
| 100 - 199 | 57,47 € |
| 200 + | 49,26 € |
Description
Learn more about the
Sophos Network Detection and Response
Sophos Central Network Detection and Response (NDR) is an advanced tool for monitoring and responding to network threats. It uses machine learning, advanced analytics and rule-based techniques to monitor network traffic and detect suspicious activity. NDR plays a crucial role in proactive security strategies to identify and respond to potential cyberattacks.
Key benefits of Sophos NDR
- Comprehensive network protocol coverage: Sophos NDR classifies traffic over 330 protocols to identify a wider range of threats.
- Advanced IOC detection: Utilizes thousands of indicators of compromise to achieve higher detection accuracy.
- Deep risk detection: Includes 50 flow risks in its detection engines to identify complex threats.
- Deep Learning Analytics: Provides high accuracy in threat detection and minimizes false positives.
- Reduced false alarms: Patented clustering and scoring technology to reduce false alarms.
Important features and functions of Sophos NDR
- Use in networks: Sophos NDR is suitable for connection with TAP/SPAN detection and analyzes network flows. In larger networks with high traffic volumes, the use of several virtual appliances is recommended.
- Integration with Sophos MDR: Sophos NDR integrates seamlessly with Sophos Managed Detection and Response (MDR), providing a more accurate picture of the entire attack pathway. This integration enables a faster and more comprehensive response to cyber threats.
- Role in the security strategy: As a comprehensive network security solution, Sophos NDR plays an important role in a holistic security strategy. It offers advanced threat detection and response, improved network visibility and efficient management of potential risks.
Sophos NDR is therefore a crucial tool for companies to effectively protect their networks from cyber threats while gaining a detailed view of network behavior.
Conceptual architecture of the NDR sensor
Sophos NDR is used as a passive traffic monitor that listens on the SPAN/Mirror port. It does not add any latency to network traffic and does not represent a weak point in the network. The data flows into the sensor, where metadata is collected and network flow details are forwarded to detection engines before being grouped and analyzed. The results are stored in the Sophos Data Lake and displayed in the Sophos Central Dashboard.
Recognition engines
Detection engines from Sophos NDR
Sophos Central Network Detection and Response (NDR) uses a range of advanced detection engines to effectively identify and combat a wide range of network threats. Each of these engines is specifically designed to detect and respond to certain types of threats or anomalies in network traffic. Here are the Sophos NDR key detection engines and their respective functions:
- Encrypted Payload Analytics (EPA):
- This engine uses machine learning to detect zero-day command-and-control (C2) servers and new variants of malware based on specific patterns. It analyzes the size, direction and inter-arrival times of network sessions to identify suspicious activity in encrypted data streams.
- Domain Generation Algorithm (DGA):
- DGA is used by malware to generate a series of domain names that can be used for C2 communication without ending up on blacklists. Sophos NDR's DGA engine recognizes these techniques and helps to uncover such disguised communication attempts.
- Deep Packet Inspection (DPI):
- This engine monitors both encrypted and unencrypted network traffic. It uses known Indicators of Compromise (IoCs) to quickly identify and analyze attackers and their tactics, techniques and procedures (TTPs).
- Session Risk Analytics (SRA):
- SRA is an advanced logic engine that generates rule-based alerts on a variety of risk factors based on network sessions. It helps to identify risks that indicate unusual or suspicious session activity.
- Device Detection Engine (DDE):
- This engine is an extensible query engine that uses deep learning technology to recognize patterns in encrypted traffic across unrelated network flows. It is crucial for detecting activities and patterns that could indicate unprotected or unauthorized devices in the network.
Each of these detection engines plays an important role in the overall context of the network security provided by Sophos NDR. By combining these diverse detection capabilities, Sophos NDR can detect a wide range of threats and enable an effective response.
Requirements
Requirements of Sophos NDR
Sophos NDR (Network Detection and Response) is an advanced solution for detecting and responding to network security threats. Certain technical requirements are necessary for the successful implementation and use of Sophos NDR, especially with regard to the supported hypervisor platforms. These are:
- VMware ESXi 6.7 and higher: This version of VMware provides a robust and reliable platform for virtualization that is compatible with Sophos NDR and enables efficient use of resources and optimal security performance.
- Microsoft Hyper-V (Windows Server 2016) or higher: Microsoft Hyper-V provides an integrated virtualization solution in Windows Server that is compatible with Sophos NDR and offers high performance and security for virtualized network environments.
These hypervisor platforms enable organizations to efficiently integrate and operate Sophos NDR within their existing virtual infrastructure to detect and respond to advanced threats.
VM system requirements for Sophos NDR
- Standard VM settings (for medium data traffic volumes):
- Up to 500 MBit/s data traffic.
- Up to 70,000 packets per second.
- Up to 1,200 data flows per second.
- Advanced VM settings (for high data traffic volumes):
- Expand to 8 vCPUs.
- Up to 1 GBit/s data traffic.
- Up to 300,000 packets per second.
- Up to 4,500 data flows per second.
Licensing
Sophos NDR licensing
Sophos NDR, an integral part of the Sophos MDR suite, is offered as a comprehensive integration package. The licensing of this advanced network detection and response system is tailored to the individual needs of a company and is based on the number of users and servers within the organization. A key feature of Sophos NDR licensing is that it enables the deployment of any number of NDR sensors within the network environment at no additional cost per instance. This licensing model provides a cost-effective and flexible solution that stands out from the more traditional, often rigid and expensive pricing structures of other providers, who normally charge per instance. With Sophos NDR, organizations can implement a scalable and adaptable network security solution that is tailored to their specific needs.
Avanet Services
Let us improve your safety
Our services are designed to help you keep your Sophos products running securely and reliably. In addition to the classic support for Sophos Firewalls or the Central platform, we offer the following services, which can be requested from us at any time:
Setup Services
Health Check
Upgrades
Workshops
Migrations
Firewall maintenance
SLA
Security audits
Request more informationSetup Services
Want to have your Sophos products set up by professionals? We support you during commissioning and configuration for smooth operation.
Migrations
You would like to change from your SG Firewall (UTM) to a XGS Firewall with the SFOS operating system? Thanks to our experience, we can also manage your changeover without any worries.
Health Check
You have set up your Sophos products yourself and would like us to check the configuration? We will check your settings and give our recommendation.
Workshops
Is it your job to be knowledgeable about Sophos products in your organization? We offer targeted training that is completely tailored to your needs.
Resources
Deepen your knowledge and learn more about “Sophos Central NDR”
Sophos Network Detection and Response (NDR) – Datasheet
Sophos Network Detection and Response (NDR) – Solution Brief
EDUCATION & GOVERNMENT
Special awards for educational and government institutions
Sophos offers special discounts for schools and government institutions to meet specific budget requirements. A discount of at least 20 % can be expected.*
Ask us and we will prepare an offer for you completely free of charge and without obligation.
* Special pricing for educational and government institutions is only available in the DACH region.
Request special pricesTrial version
Try Sophos Central for free
Try out the powerful platform for centralized security management free of charge for 30 days.
All products - Test the complete protection package, including XDR protection for endpoints, email, mobile devices and servers.
One console - work efficiently by managing all Sophos products from a single cloud platform.
Immediate access - ready for use in just a few minutes.
Use the following login details to start your online demo. Username: demo@sophos.com / Password: Demo@sophos.com
Help with purchase
Are there any questions about the product?
It is better to ask again before buying, before you end up holding the wrong product in your hands.
Ask question| Runtime | 1 year, 2 years, 3 years |
|---|---|
| Type | Initial purchase, Renew |