I would add that NDR tools do not look just at network traffic. Most of the vendors have realized that the cloud is now part of the network and are intaking and analyzing AWS, Google, and MS cloud information looking for risks and threats.
I would also add that many mid and small-sized companies either outsource or do not run a SIEM because they are complex and require security analyst resources they often cannot afford.
Many will run EDR and NDR on-premise or outsource the entire stack to an MSSP and MDR vendor.
Search for a product comparison in Security Information and Event Management (SIEM)
Head of International Marketing (EMEA & APJ) at Vectra AI
Real User
2021-09-06T06:29:10Z
Sep 6, 2021
"SIEM's are incredibly fixable technology platforms that can be used within your environment to discover advanced threats and to fill gaps in coverage for other tools. In theory, you could replicate a lot of EDR use cases in a SIEM by forwarding all endpoint data and building your own searches and data models but it wouldn't be cost- or operational-effective. This is why we have EDR tools.
The same goes for NDR. While many organisations have attempted to solve NDR use cases with their SIEM tools but have had limited success and are quite cost-prohibitive to build and maintain these solutions. Networks threats are getting more complex and more widespread and organisations need to invest in specialist tools like NDR that provide insights into the threats within your network rather than solutions that just allow you to search on raw data. While most organisations will more than likely require a SIEM to fill some edge cases in their technology stack more often than not organisations save in both upfront and ongoing costs by investing in a strong NDR solution before investing in a SIEM".
CISO at a religious institution with 501-1,000 employees
Real User
2021-03-23T15:48:42Z
Mar 23, 2021
Your SIEM should receive and process traffic generated by your NDR as well as events from your endpoint protection systems, server event logs, infrastructure device logs and cloud services logs then be able to correlate these data points to highlight suspicious patterns or anomalies. The SIEMs can then send commands to perimeter and point systems in certain cases to interrupt such activity or just alert to them.
Information Security Manager at a retailer with 10,001+ employees
Real User
Top 5
2021-03-22T14:25:13Z
Mar 22, 2021
SIEM aggregates data from multiple systems (like an EDR solution, IDS/IPs etc.) and analyze that data to catch abnormal behavior or potential cyberattacks. SIEM tools offer a central place to collect events and alerts, security data from network devices, servers, domain controllers and more. In a simple way, EDR may be a just another "sensor-type" and "SIEM" stores, normalizes, aggregates, and applies analytics to that data to discover trends, detect threats, and enable organizations to investigate any alerts.
Vice President & Country Head at Inspira Enterprise
Reseller
2021-03-22T07:43:13Z
Mar 22, 2021
NDR is just analysis of network behaviour and forms a part of SIEM strategy. it can only detect anomaly in network traffic flow . SIEM takes logs of network flow also.
NDR and SIEM are two different types of tools used by security professionals.
You don't need a SIEM to run an NDR solution or vice versa. Larger organizations or mature organizations tend to have both in addition to other tools like EDR and SOAR.
Today's NDR's are typically designed to provide network visibility and detection across your entire network (East-West, North-South) and yes the network is no longer just your on-prem environment. It also includes your Cloud environment as most NDR solutions support AWS, Azure, and GCP.
NDR tools can generate PCAP data, network log and metadata, and alert data all of which can be consumed by a SIEM.
SIEMs in many organizations are the log aggregation tools and data laking solutions for the security team. For small organizations that just want NDR, most solutions offer their own UI and don't require a SIEM.
For those organizations that already have a SIEM, the NDR is one of the most valuable tools to generate forensic data.
You can learn more about NDR solutions from Bricata's ebook on "What to look for in an NDR".
Find out what your peers are saying about Splunk, Wazuh, Microsoft and others in Security Information and Event Management (SIEM). Updated: August 2025.
hello.
NDR generate source events from network traffic.
SIEM gethering one or more as well as NDR events AND correlation analysis.
So company need both system
Security Information and Event Management (SIEM) tools offer comprehensive visibility and management of an organization’s security events through real-time analysis and correlation of data from multiple sources.
SIEM solutions provide a centralized platform for managing security alerts and logs from various sources such as network devices, servers, and applications. They help identify and mitigate potential threats by analyzing event data for unusual patterns and correlations. These tools...
The answers are all solid.
I would add that NDR tools do not look just at network traffic. Most of the vendors have realized that the cloud is now part of the network and are intaking and analyzing AWS, Google, and MS cloud information looking for risks and threats.
I would also add that many mid and small-sized companies either outsource or do not run a SIEM because they are complex and require security analyst resources they often cannot afford.
Many will run EDR and NDR on-premise or outsource the entire stack to an MSSP and MDR vendor.
"SIEM's are incredibly fixable technology platforms that can be used within your environment to discover advanced threats and to fill gaps in coverage for other tools. In theory, you could replicate a lot of EDR use cases in a SIEM by forwarding all endpoint data and building your own searches and data models but it wouldn't be cost- or operational-effective. This is why we have EDR tools.
The same goes for NDR. While many organisations have attempted to solve NDR use cases with their SIEM tools but have had limited success and are quite cost-prohibitive to build and maintain these solutions. Networks threats are getting more complex and more widespread and organisations need to invest in specialist tools like NDR that provide insights into the threats within your network rather than solutions that just allow you to search on raw data. While most organisations will more than likely require a SIEM to fill some edge cases in their technology stack more often than not organisations save in both upfront and ongoing costs by investing in a strong NDR solution before investing in a SIEM".
Your SIEM should receive and process traffic generated by your NDR as well as events from your endpoint protection systems, server event logs, infrastructure device logs and cloud services logs then be able to correlate these data points to highlight suspicious patterns or anomalies. The SIEMs can then send commands to perimeter and point systems in certain cases to interrupt such activity or just alert to them.
SIEM aggregates data from multiple systems (like an EDR solution, IDS/IPs etc.) and analyze that data to catch abnormal behavior or potential cyberattacks. SIEM tools offer a central place to collect events and alerts, security data from network devices, servers, domain controllers and more. In a simple way, EDR may be a just another "sensor-type" and "SIEM" stores, normalizes, aggregates, and applies analytics to that data to discover trends, detect threats, and enable organizations to investigate any alerts.
NDR is just analysis of network behaviour and forms a part of SIEM strategy. it can only detect anomaly in network traffic flow . SIEM takes logs of network flow also.
NDR and SIEM are two different types of tools used by security professionals.
You don't need a SIEM to run an NDR solution or vice versa. Larger organizations or mature organizations tend to have both in addition to other tools like EDR and SOAR.
Today's NDR's are typically designed to provide network visibility and detection across your entire network (East-West, North-South) and yes the network is no longer just your on-prem environment. It also includes your Cloud environment as most NDR solutions support AWS, Azure, and GCP.
NDR tools can generate PCAP data, network log and metadata, and alert data all of which can be consumed by a SIEM.
SIEMs in many organizations are the log aggregation tools and data laking solutions for the security team. For small organizations that just want NDR, most solutions offer their own UI and don't require a SIEM.
For those organizations that already have a SIEM, the NDR is one of the most valuable tools to generate forensic data.
You can learn more about NDR solutions from Bricata's ebook on "What to look for in an NDR".
hello.
NDR generate source events from network traffic.
SIEM gethering one or more as well as NDR events AND correlation analysis.
So company need both system