Network Detection and Response uses specialized detection using Docker plugins that expand the detection capabilities of the ML engines. It allows the Trellix security research team to package advanced detection logic and bundle them into portable containers, enabling faster response to emerging threats. These plugins receive metadata, events, and flow records from connected devices (such as NX, PX, and IPS) and process them against sophisticated detection logic to raise alerts in the NDR.
Detection capabilities
The anomaly detection is distributed across a shared docker container and few dedicated containers, each focusing on specific threat behaviors:
Container name | Description |
|---|---|
| A shared docker container that hosts multiple plugins, such as the following:
|
| An individual container hosting DNS tunneling plugin for advanced identification of tunneling behaviors used for covert communication or data leakage. |
| An individual container hosting DGA plugin to detect Domain Generation Algorithm–based command-and-control domains used by modern malware |
| An individual container hosting NeURL plugin, extending anomaly detection through neural-based analysis of DNS traffic patterns. |
How the docker detection plugins work
When you have the required licenses, the plugins are downloaded automatically from the DTI gateway server. The system is designed for zero-touch automation –
The NDR automatically checks the Trellix Security Content Hub every 5 hours for new container images or logic updates.
If an update is detected, the console stops existing containers, fetches the new Docker images, and restarts them automatically.
When the NDR receives network events, it forwards them to these containers for real-time analysis.
If a detection rule is matched, an alert is instantly generated and displayed on the UI.