XcellSecure|Network Detection & Response
The network doesn't lie. We watch it, so attackers can't move quietly inside it.
Passive sensors see east-west traffic between your own servers, fingerprint encrypted sessions without decrypting them, and hand our 24×7 SOC the evidence to contain fast.
Logs can be wiped. Agents can be killed. Packets still have to cross the wire.
Network detection and response watches a copy of your traffic, learns what normal looks like for each segment, and flags the movement attackers can't avoid: scanning, hopping between servers, calling home and moving data out.
Sees what systems log. Blind where logging is off, tampered or never existed.
NG-SIEM →Sees what happens on managed endpoints. Blind on printers, cameras, OT, appliances and unmanaged laptops.
Defender →Sees what moves between every device with an IP address — agent-free, and hard for an attacker to switch off.
This pagePerimeter tools inspect traffic in and out. Once someone is inside, the traffic between your own machines usually goes unwatched — and that is where ransomware operators spend days before they strike.
| Approach | Signature IDS | Flow monitoring | NDR |
|---|---|---|---|
| Known exploits | Yes | No | Yes (IDS built in) |
| Unknown behaviour | No | Volume only | ML baselines |
| Encrypted sessions | Blind | Size & time | Fingerprints + timing |
| Protocol detail | Per rule | No | SMB, RDP, DNS, Kerberos… |
| Response | Alert | Alert | Block · isolate · quarantine |
Copy, inspect, decide, act. Hover any part of the path.
Sensors sit out-of-band on a copy of traffic, so they can't slow or break your network. Only metadata and alerts leave the site; packets stay local unless an investigation needs them.
Hover or tap any block
Each block shows what it does and what we configure.
Seven things our NDR does. Every day, on every sensor.
Detection is only useful if someone acts on it. Each capability below ends with an action our SOC can take.
- 01Asset discovery→ unmanaged-device report
Every device that talks is inventoried — including printers, cameras, OT controllers and the laptop nobody enrolled.
- 02Behavioural baselines→ anomaly score on each alert
ML learns normal peers, ports, volumes and times per host and segment over two to four weeks, then scores deviations.
- 03Encrypted traffic analytics→ C2 and tunnel detection
JA4+ fingerprints, certificate details, packet sizes and timing reveal malware and tunnels inside TLS without decryption.
- 04Lateral movement detection→ host isolation via EDR
Unusual SMB, RDP, WinRM and Kerberos patterns, admin shares and remote execution between hosts that never talked before.
- 05Exfiltration & DNS abuse→ firewall block
Large or slow outbound transfers, DNS tunnelling, algorithm-generated domains and uploads to new destinations.
- 06Signature IDS→ prioritised alert
Suricata* rules for known exploits and malware families, tuned per site so analysts don't drown in noise.
- 07Forensic record→ evidence pack
Months of searchable metadata and a short rolling packet capture on the sensor for investigations and CERT-In evidence.
Most traffic is encrypted. Its shape still gives malware away.
We don't break TLS by default. Decryption adds risk, cost and privacy duties; behaviour and fingerprints catch most of what matters.
t13d1715h2_sample_a1rare in your estateself-signed · 3 days oldsuspiciouscdn.example.netvisible today212 B out · 96 B in, every timeuniformevery 60 s ± 4 s · 24 hbeaconJA3 (2017) hashed the TLS ClientHello. JA4+, published by FoxIO in 2023, is a family of readable fingerprints for TLS, QUIC, HTTP, SSH and certificates that is harder to evade by shuffling extensions.
Published by the IETF in March 2026, ECH hides the server name from on-path observers. As adoption grows, SNI-based rules weaken — timing, size, fingerprint and DNS signals carry more of the load.
Where policy allows, inspection runs on your firewall or a dedicated decryption point — never on our sensors — with exclusions for banking, health and personal categories under your DPDP notice.
Techniques the network can see. Filter by tactic.
NDR is strongest in the middle and end of an attack — discovery, lateral movement, command and control, exfiltration. That's where it complements EDR and identity signals in the NG-SIEM.
Technique IDs from attack.mitre.org (Enterprise v20, 13 October 2026). "What we see" is XcellHost's description of network evidence, not MITRE's text, and not a coverage score.
Sites × bandwidth. How many sensors, which size, how much data.
Enter your sites and peak link speeds. We add headroom, pick a sensor class per site and estimate the metadata your SIEM will receive. Illustrative — a site survey confirms it.
Sensor classes (1, 10, 40 Gbps) and the metadata ratio are planning assumptions. SIEM cost uses the illustrative Sentinel rates on our NG-SIEM estimator.
Malware phones home on a timer. Find the timer.
One hour of synthetic outbound connections from six pseudonymised hosts. For each host-destination pair we measure how regular the gaps are (coefficient of variation). Very regular plus repeated plus not allow-listed = likely beacon.
Synthetic sample, pseudonymised hosts, documentation IP ranges and example domains. Fingerprints shown are placeholders, not real JA4 values. Real detections combine timing with fingerprint rarity, destination age and threat intelligence.
Open-source sensors, your existing tools. One SOC on top.
We build on proven open-source engines, can run a commercial NDR you already own, and close the loop through your firewall, EDR and SIEM.
Sensors
- Zeek* — protocol & flow metadata (open source)
- Suricata* — IDS signatures (open source, OISF)
- JA4+ fingerprints (FoxIO*)
- Arkime* — indexed packet capture
Commercial NDR
- Vectra AI*
- Corelight*
- ExtraHop*
- FortiNDR* · Fortinet
Response
Cloud & OT
- AWS VPC Traffic Mirroring*
- Google Cloud Packet Mirroring*
- Azure VNet flow logs (replacing NSG flow logs)
- Microsoft Defender for IoT for OT · OT assessment
SIEM
- Microsoft Sentinel — data lake for metadata · Managed Sentinel
- Splunk*, Elastic*, Google SecOps*
- Wazuh* (open source)
Cases
- Case Management — evidence & timers
- ServiceNow*, Jira*, Zoho Desk*
- UEBA — user context on network alerts
* Partner or third-party products, trademarks of their owners; listed for integration only. XcellHost is a Microsoft Gold Partner.
Sensors at your sites. Analysis and people in India.
Three models. In all of them packets stay on your premises, metadata is stored in India and our SOC works from Mumbai.
XcellHost runs everything
We supply virtual or physical sensors, run the analytics on XcellHost infrastructure in our Mumbai Tier IV data centre and triage 24×7. You approve containment actions or pre-authorise them by playbook.
- Metadata stored in Mumbai
- 24×7 triage and containment
- Monthly report and tuning
Mid-size firms without a SOC; plants and multi-site businesses.
Your team by day, ours 24×7
Shared console and runbooks. Your analysts work business hours; we cover nights, weekends and escalations, and keep detections tuned.
- Shared queue and RBAC
- Follow-the-clock handover
- Runbooks you own
Banks, NBFCs and enterprises with an in-house team that needs 24×7 cover.
Everything in your environment
Sensors, analytics and storage in your data centre or your Azure subscription in an Indian region. We operate it remotely with least-privilege, logged access.
- No data leaves your tenant
- Just-in-time admin access
- Every session logged
Regulated entities with strict residency or outsourcing rules.
6 h to report specified incidents; 180 days of ICT logs kept in India — network metadata included.
SOC monitoring is expected of regulated entities; NDR covers network visibility that log-only SOCs lack.
No payload storage by default; metadata retention and access are written into your policy. DPDP platform →
Two weeks to see your network. Then we watch it for you.
A visibility trial first, so you see real findings before you commit.
Links, SPAN capacity, cloud VPCs, OT zones.
Sensors on your busiest segment; asset list and findings report.
All sites live, baselines learnt, response playbooks agreed.
Triage, containment, hunting and monthly review.
Priced per sensor. Response included from the middle plan up.
Sensor hardware or cloud compute is quoted separately. Indicative, excl. 18% GST.
- Asset discovery & metadata
- IDS signatures, tuned
- Alerts to your team, business hours
- Monthly findings report
- ML baselines & encrypted traffic analytics
- 24×7 SOC triage
- Containment via firewall, EDR, NAC
- CERT-In reportability check
- Monthly tuning review
- Weekly threat hunting
- Extended PCAP & forensics
- OT protocol coverage
- Quarterly business review
- Named analysts
All three NDR plan prices and the per-site deployment fee (₹29,999) are placeholders — indicative, confirm with XcellHost. Add-ons in the builder (Managed Sentinel, CERT-In retainer, Sentinel cost review, Security Operations) use the exact prices on their linked XcellHost pages.
Build your NDR service. See the first invoice.
Sensors, sites and plan; then add the SIEM and SOC pieces you need. First invoice = one-time items plus the first month.
XcellSecure NDR
NDR plan and deployment prices are placeholders — indicative, confirm with XcellHost. Other items as on the linked pages. Excl. 18% GST in the lines above; sensor hardware quoted separately.
NDR, answered.
Network detection and response watches a copy of your network traffic, learns normal behaviour, detects threats such as lateral movement, command-and-control and data theft, and helps contain them through your firewall, EDR and network access control.
No. Sensors are out-of-band: they receive a copy of traffic from a SPAN port, a network TAP or cloud packet mirroring and never sit in the traffic path. If a sensor fails, your network carries on as before.
They see different things. EDR covers managed endpoints; a SIEM sees what systems log. NDR covers everything with an IP address — including unmanaged laptops, printers, cameras, OT and appliances — and is hard for an attacker to disable. Together they are often called the SOC visibility triad.
Through what encryption doesn't hide: TLS fingerprints (JA3, JA4+), certificate details, packet sizes, timing and destination history. A malware beacon calling out every 60 seconds looks very different from a person browsing. We decrypt only where your policy allows, on your firewall — not on our sensors.
ECH, published as RFC 9849 in March 2026, encrypts the server name in the TLS handshake, so network tools can no longer rely on SNI where it is used. Our detections lean on timing, fingerprints, DNS and destination reputation, which ECH does not remove.
Not by default. Sensors keep a short rolling packet buffer locally for investigations; only metadata and alerts are sent for analysis and stored in India. Longer capture is available on the Hunt plan with retention written into your policy.
Yes, passively — which matters, because active scanning can disrupt industrial controllers. We use OT-aware sensors such as Microsoft Defender for IoT on a one-way feed and start with an OT assessment. See also OT security.
Usually one per data centre core, one per large campus and a virtual sensor per cloud network; branches can be covered at the SD-WAN hub. Use the sizing tool for a first count — a site survey confirms it.
Yes. Network metadata is part of the 180-day ICT logs CERT-In expects in India, and on Detect & Respond every incident gets a reportability check with an evidence pack. A CERT-In incident reporting retainer (₹14,999/month, as on Managed Sentinel) is in the builder.
No. NDR plan prices and the deployment fee are placeholders, indicative only, and are confirmed in a written INR quotation with 18% GST. Sensor hardware or cloud compute is quoted separately; add-on prices are as on the linked XcellHost pages.