The NDR uses two distinct connection modes to manage how it interacts with Mandiant Threat Intelligence. The mode determines whether an appliance actively downloads and searches for IOCs or simply stores results.
Supported Nodes | Connection | Description |
|---|---|---|
Master node | (0). Data Node Full Mode | In this mode, the Data node downloads the indicators, performs the searches locally, and stores the results. |
Master node | (1). Data Node Index Only Mode | In this mode, the Data node only stores results, while all search operations are performed on the Director. Any requests for context from iSight are forwarded to the Director. For this setup to function correctly, the Director must be running in Director Full Mode. |
Director node | (2). Director Full Mode | In this mode, the Director downloads and stores the indicators, performs the searches, and then delegates the results to the Data Node for storage. For this setup to work properly, the Data Node must be running in Data Node Index Only Mode. |
Master node | (3). Director Node Read Only Mode | In this Mode, the Director node only works toprovide the context to the alerts visibleon the director |
Note
In a clustered NDR deployment, the Director node must be configured in Full Mode, and all associated data nodes must be configured in Index Only Mode. This architecture centralizes the threat intelligence download and search functions on the Director, which then distributes the results to the data nodes.