Internal NDR-Class Network Detection
Lateral-movement detection built in-house, without an enterprise NDR license.
An in-house network behavioral monitoring system for east-west traffic and lateral movement, a class of tool usually bought from enterprise vendors.
Team of one· Solo architect & engineer
No team, no agency, no hand-offs. I owned this project end to end:
- Requirements
- Architecture
- Infra & deployment
- Stack
- NDRNetwork SecurityBehavioral DetectionLinuxEast-West Traffic
What was broken, and what fixed it
Problem: An attacker inside the network moves sideways between machines, where perimeter tools do not look.
Fix: Linux sensors watch east-west traffic between internal machines and surface behavior that looks like lateral movement or other anomalies to the IT team.
Problem: Commercial NDR products carry enterprise license costs.
Fix: Built in-house on open tooling and the cooperative's own Linux hosts, so there is no license to renew and traffic data stays in-house.
Approach
- Build in-house on open tooling instead of buying a license.
- Focus on east-west traffic and anomalies, not just the perimeter.
What I built
- East-west traffic monitoring
- Lateral-movement and anomaly detection
- Runs on Linux with open tooling
Architecture
Infrastructure & delivery
- NDR
- Network Security
- Behavioral Detection
- Linux
- East-West Traffic
- 1LinuxNetwork
Sensors on Linux watch east-west traffic between internal machines, not just the perimeter.
- 2Network
Traffic is analyzed for behavior that looks like lateral movement or other anomalies.
- 3Detection
Detections surface to the IT team for investigation.
Engineering
- Built on open tooling, so there is no enterprise NDR license to renew.
- Runs on the cooperative's own Linux hosts, so traffic data stays in-house.
- Detection focuses on behavior inside the network, the blind spot that perimeter tools leave.
Outcome
- NDR-class detection built in-house, with no enterprise license.