baselineRFIWhat network traffic sources does the platform ingest — physical/virtual TAPs, SPAN ports, cloud VPC flow logs/mirroring, encrypted traffic metadata — and which cloud providers are natively supported?weight 3
Answer key — what a strong answer shows
Look for explicit cloud-native traffic ingestion, not just on-prem TAP/SPAN, since a growing share of traffic never touches a physical network the customer controls.
baselineRFPDescribe how the platform analyzes encrypted traffic without decryption (JA3/JA3S fingerprinting, TLS metadata, behavioral analysis) and provide a measured detection-rate figure for a specific technique (e.g., C2 beaconing) from a customer reference.weight 3
Answer key — what a strong answer shows
Strong answers name specific encrypted-traffic-analysis techniques and give a real detection figure, not a vague 'we see through encryption' claim.
baselineRFIWhat is the retention window for full packet capture versus metadata/flow records, and can an analyst pivot from an alert to the original raw packets for forensic investigation?weight 3
Answer key — what a strong answer shows
Look for a stated retention window for each data type and confirm forensic pivot-to-PCAP capability, which is often a paid add-on or missing entirely.
baselineRFIHow does the platform detect lateral movement specifically (east-west traffic analysis), distinct from north-south perimeter-focused detection?weight 3
Answer key — what a strong answer shows
East-west visibility is the core NDR value proposition distinct from a firewall/IDS — a vendor that can't articulate this specifically may be reselling perimeter detection under an NDR label.
baselineRFPDetail integration with EDR/XDR platforms for correlated detection — can a network-observed anomaly be automatically correlated with endpoint telemetry for the same host, and what is the false-positive reduction from that correlation with a customer reference?weight 3
Answer key — what a strong answer shows
Look for real cross-domain correlation with a measured false-positive improvement, not just 'integrates with your SIEM.'
baselineRFIWhat is the model update/tuning cadence for the platform's detection models, and how does the platform avoid alert fatigue as network baselines change over time (e.g., new applications rolled out)?weight 3
Answer key — what a strong answer shows
Strong answers describe adaptive baselining and a stated model-update cadence; a static model trained once will drift into noise as the network changes.
baselineRFPExplain sensor deployment and licensing model — is it priced per sensor, per bandwidth (Gbps), or per asset — and what is the typical cost/complexity of extending coverage to a new site or cloud region?weight 3
Answer key — what a strong answer shows
Look for a transparent, itemized pricing model and a real example of extending coverage, since NDR licensing is often a major hidden-cost surprise.
baselineRFIDoes the platform support encrypted traffic decryption via SSL/TLS inspection as an alternative or complement to metadata-only analysis, and what performance/privacy tradeoffs does the vendor disclose?weight 3
Answer key — what a strong answer shows
Look for honest disclosure of the performance overhead and privacy implications of decryption-based inspection, not just a feature checkbox.
baselineRFIHow deep is visibility into cloud-native/Kubernetes east-west traffic specifically (pod-to-pod, service-mesh traffic), distinct from traditional data-center or cloud-VPC-level network visibility, and is this a native capability or a separate product/module?weight 3
Answer key — what a strong answer shows
Container/Kubernetes east-west visibility is a materially different technical challenge than traditional network monitoring — a vendor should give an explicit answer rather than implying general 'cloud visibility' covers it.
baselineRFPDetail the query/threat-hunting interface available to analysts for investigating raw traffic data — is it approachable for an analyst without deep networking expertise, and what ramp-up time does a customer reference report for a new analyst to become self-sufficient?weight 3
Answer key — what a strong answer shows
Strong answers give a concrete, customer-validated ramp-up timeline; a powerful but expert-only interface creates a real staffing bottleneck, especially for smaller SOC teams less familiar with deep packet/flow analysis.
baselineRFIWhat compliance and forensic evidence generation does the platform provide from captured network data (e.g., proof of network monitoring coverage for an audit, or exportable packet-level evidence for a legal/HR investigation)?weight 3
Answer key — what a strong answer shows
Native compliance/forensic-evidence export is a distinct capability from raw detection — ask whether this exists as a built-in report or requires manual data extraction.
baselineRFPExplain incident-response escalation integration — when NDR identifies a likely major incident (e.g., confirmed C2 beaconing), is there a direct, automated escalation path to an IR team or retainer service, or does escalation rely entirely on manual analyst judgment?weight 3
Answer key — what a strong answer shows
An automated or semi-automated escalation path reduces response time for genuinely critical network-based incidents versus relying purely on an analyst noticing and manually initiating escalation.
baselineRFIWhat is the platform's measured false-positive rate in production deployments, and what tuning burden does a typical SOC team face in the weeks after initial deployment as the platform learns the customer's network baseline?weight 3
Answer key — what a strong answer shows
Look for a real, customer-validated false-positive figure and an honest description of the baseline-learning/tuning period — 'accurate from day one' claims should be scrutinized.
baselineRFPDetail a customer-referenced onboarding timeline from contract signature to the platform producing genuinely useful, tuned detections, and what customer-side effort (sensor placement, network access, baseline tuning) that requires.weight 3
Answer key — what a strong answer shows
Strong answers give a concrete, customer-validated timeline and are honest about the customer-side effort required, not just vendor-side sensor deployment time.
baselineRFIHow consistent is detection quality and sensor deployment across a large, multi-site or multi-region global organization — does coverage and detection model quality degrade at smaller/remote sites, or is it uniform regardless of site size?weight 3
Answer key — what a strong answer shows
A vendor should give an honest answer about whether smaller/remote sites get materially weaker coverage — this is a common practical gap for organizations with many small offices or remote locations.
baselineRFIDoes the platform's traffic analysis extend meaningfully into OT/ICS network segments, or is it purely IT-network-focused with OT traffic either ignored or misclassified due to unfamiliar protocols?weight 3
Answer key — what a strong answer shows
Standard IT-focused NDR platforms frequently mishandle OT-specific protocols — a vendor should clarify this scope boundary explicitly for a customer with converged IT/OT networks.
baselineRFPDemonstrate the technology's ability to detect and respond to adversarial cyber activity on OT networks in the energy sector through a collective defense approach.weight 3
baselineRFPProvide Network Analysis Threat Prevention/Detection.weight 3
baselineRFPNetwork Threat Hunting should leverage Netflow, Proxy, DNS, IPS, VPN, Firewall, AD/Windows and Email logs to enable hunting for Lateral Movement, Malware Beaconing, Data Exfiltration, Watering Hole, Targeted network attacks, and Dynamic DNS attacks, and must be capable of identifying suspicious or hitherto undiscovered communication patterns.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
