SensorFleet NDR is an open network detection and response platform designed for deployment across information technology (IT), operational technology (OT), and software-defined networks (SDN). The architecture consists of a centralized Fleet Management component for control, Sensors deployed as hardware appliances, virtual machines, or cloud-native instances, and Instruments. Instruments are containerized applications that run on the Sensors to perform specific cybersecurity tasks like attack detection, exposure monitoring, and forensic data collection.
The platform utilizes Linux Containers (LXD) to run multiple security tools (Instruments) in isolated environments, enforcing privilege separation and providing encrypted, isolated storage for each tool. It offers granular control over network access and employs a supervised message bus for communication between Instruments, removing the need for direct network or filesystem links. Capabilities enabled by various Instruments include intrusion detection using tools like Suricata and Zeek, full packet capture, NetFlow collection, asset discovery, and honeypot deployment. The system also contains helper utilities, such as a Capture Engine for packet mirroring and a downloader for securely fetching external resources.
