Mirrored traffic
Network TAP
Switch SPAN port
Agentless NDR for centralized network visibility.
Deploy Network Detection and Response without installing software on every endpoint. Red Hand Agentless NDR continuously analyzes mirrored TAP or SPAN traffic from a central collection machine to detect suspicious behavior across your network.
No endpoint agentsContinuous analysisCentralized visibility
Request a Free Trial
Tell us how to reach you. We will contact you to discuss your network, mirrored traffic source, and Agentless NDR deployment requirements.
By submitting this form, you agree that Red Hand may contact you about this request.
How Red Hand Agentless NDR works
Central collection. Continuous Network Detection and Response.
A dedicated machine collects mirrored traffic inside your network. Detection, enrichment, and behavioral analysis run continuously on redhand.io.
Red Hand Agentless NDR
Observes mirrored TAP or SPAN traffic and produces compact network telemetry.
Running continuouslyAnalysis engine
Enriches traffic data and continuously evaluates network behavior.
Analyzing nowInvestigation-ready findings
Suspicious behavior
Endpoint intelligence
Recommended next step
Agentless NDR benefits
Monitor more of the network without endpoint agents.
Use existing TAP or SPAN traffic mirroring to extend Network Detection and Response across endpoints, servers, appliances, and devices that cannot run collection software.
01
Broader coverage
See diverse network devices
Observe traffic from managed and unmanaged systems, infrastructure, appliances, and other devices visible at the monitoring point.
Coverage depends on which traffic is forwarded to the TAP or SPAN destination.02
Central deployment
Avoid per-endpoint installation
Add continuous network behavior analysis without deploying and maintaining collection software on every monitored device.
One dedicated collection machine receives the mirrored traffic and streams telemetry for analysis.03
Richer assessment
Put communications in context
Evaluate destinations using threat intelligence, reputation, ownership, WHOIS, popularity, and other endpoint information.
Red Hand uses this context to escalate suspicious communications and de-escalate expected activity.Agentless NDR requirements
What you need for centralized traffic collection.
Agentless NDR avoids endpoint installation by collecting traffic at a central point in your network.
01
Mirrored traffic
A TAP or SPAN source
Configure a network TAP or switch SPAN port to forward the traffic you want Red Hand to monitor.
02
Local collection
A dedicated machine
Provide a machine connected to the destination interface receiving the mirrored network traffic.
03
Cloud analysis
Outbound connectivity
Allow the collection machine to continuously send compact traffic telemetry to redhand.io for analysis.