Alibaba Cloud Agentic NDR is a Network Detection and Response (NDR) security product that monitors and analyzes all network traffic to identify and respond to potential security threats.
Once you onboard your cloud assets, Agentic NDR automatically detects:
Malicious attacks and intrusion attempts across your cloud assets
Anomalous behaviors identified through behavioral analysis and threat intelligence
Attack stage and outcome mapped to the ATT&CK framework
Raw traffic and protocol-level evidence for incident investigation
Access management
To protect your public-facing assets, onboard their traffic to Agentic NDR first. Agentic NDR supports two onboarding methods: automatic full onboarding and manual on-demand onboarding. Activation is instant and requires no deployment.
| Feature | Description | References |
|---|---|---|
| Internet traffic access | Connect traffic from cloud assets with elastic IP addresses (EIPs) or public IP addresses—including ECS, SLB, NAT, and elastic network interfaces (ENIs)—with a single click. Choose between two onboarding methods: Automatic full onboarding onboards all traffic from assets with EIPs or public IP addresses in a specific region; Manual on-demand onboarding syncs the full asset list and lets you select specific assets to onboard. | Provisioning |
Packet retention
After onboarding, retain and retrieve attack packets directly from the console. Configure packet capture (PCAP) filter rules to focus retention on specific business assets, and create PCAP generation tasks to download raw traffic for deeper analysis.
| Feature | Description | References |
|---|---|---|
| Packet retention and retrieval | Agentic NDR automatically retains raw traffic for any attack event that triggers an alert. Retrieve captured packets from the console using advanced query tools, including BPF (Berkeley Packet Filter). | Retrospective analysis |
| Packet retention filter rules | Configure retention rules for traffic from core business assets. Rules support blacklist and whitelist filtering logic. Create, retrieve, update, and delete rules as needed. | Retrospective analysis |
| PCAP generation tasks | Manage all packet capture (PCAP) generation tasks in one place. View and filter historical tasks, then download the captured packets to your local machine. | Retrospective analysis |
Threat analysis
Once traffic is onboarded, Agentic NDR automatically runs four detection engines—signature-based detection, threat intelligence, malicious file analysis, and behavioral analysis—to identify malicious attacks and anomalous activity. It analyzes bidirectional request and response traffic, correlates related events, and maps attacks to the ATT&CK framework to determine attack stage and outcome.
| Feature | Description | References |
|---|---|---|
| Alert analysis | Detect malicious attacks and abnormal behaviors in service traffic. In alert details, view the alert list, detailed alert information, and attack packet payload online. Correlated events between the same suspect and victim are grouped together. Retrieve attack packets and download PCAP tasks. | Threat analysis |
| ATT&CK matrix | Aggregate alert events by the ATT&CK framework. Agentic NDR automatically determines the attack stage and outcome for each aggregated event. Drill into aggregated alerts by specific tactics and techniques. | Threat analysis |
| Alert whitelist | Suppress false positive alerts by adding rules to a whitelist. Configure rules based on stream information, protocol fields, and rule information. Create, retrieve, update, and delete whitelist rules as needed. | Threat analysis |
Log analysis
Log analysis provides deep threat insights from bidirectional traffic. Agentic NDR generates detailed protocol logs that you can retain for investigation, or deliver to other services for correlation and long-term storage.
| Feature | Description | References |
|---|---|---|
| Log retrieval | Retrieve Layer 7 protocol logs—including HTTP, DNS, and TLS—and 5-tuple logs from the console. Filter by source IP, port, protocol, direction, and other conditions. Log details include all fields and payload information from the raw log. | Log analysis |
| Log filter rules | Define retention rules for protocol logs on demand. Supports a wide range of log types and field filter conditions. Create, retrieve, update, and delete filter rules as needed. | Log analysis |
| Log delivery | Deliver all protocol logs to Simple Log Service (SLS) within seconds. | Log analysis |