Aegis NDR needs no SPAN port, TAP or traffic mirroring. An agent on each node watches outbound connections and detects C2 channels, data exfiltration and suspicious DNS directly at the source — where the attack actually happens.
A compromised system almost always has to call out somewhere: to pull a tool, check in with a command server or exfiltrate data. Aegis NDR puts exactly that outbound traffic under watch.
Every outbound connection under watch — with the process and user that opened it, not just an IP and port.
Recognition of command-and-control channels toward known and reputationally suspicious destinations.
Unusual data-egress patterns — large or periodic transfers to the outside.
DNS tunneling and algorithmically generated domains (DGA) as an early signal of compromise.
A connection tied to a specific process and user — the investigation starts with context, not a bare IP.
A risky destination is blocked at the firewall; geo rules stop traffic toward undesirable regions.
Classic NDR requires you to mirror network traffic to a probe (SPAN/TAP). That means hardware, configuration on every switch and blind spots wherever there is no physical network — in the cloud, for example. Aegis observes traffic from an agent on the host.
| CRITERION | Aegis NDR (agent) | Classic NDR (SPAN / TAP probe) |
|---|---|---|
| Network hardware required | ✓ Not required | SPAN port, TAP, probe |
| Visibility in the cloud and on VMs | ✓ Yes, the agent runs everywhere | Difficult — no physical port |
| Encrypted traffic | Sees the destination, process and intent | Sees only flow metadata |
| Attribution to process and user | ✓ Which application opened the connection | ✗ Only IP and port |
| Deployment | Agent installation, minutes | A network project, days |
Aggregated, anonymised and illustratively rounded production metrics from the Aegis network.
NDR (Network Detection and Response) is a discipline that detects attacks by observing network traffic, not just application logs. The idea is simple: an attacker may bypass defenses at one layer, but can hardly hide communication with the outside world.
Traffic entering and leaving the organization is called north-south, while traffic between internal systems east-west. The Aegis agent sees both sides from each host's perspective, so an attacker's lateral movement isn't hidden behind a single network hop.
Almost every serious attack opens an outbound connection at some point — a command & control channel, downloading a second-stage tool or data exfiltration. Monitoring outbound connections therefore catches the attack even when the initial entry slipped through.
NDR works best paired with SIEM correlation i WAF protection: the WAF guards the entrance to web applications, SIEM joins events together, and NDR covers what goes out.
A demo on your traffic shows outbound connections, suspicious domains and the processes that open them — without deploying a SPAN port.