Skip to content
Find out how we support MDR.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=NDR

Sophos NDR

Log collector Sophos Network Detection and Response

You must have the Sophos Network Detection and Response integration license pack to use this feature.

Sophos Network Detection and Response (NDR) detects malicious behavior on your network.

You can integrate Sophos NDR with Sophos Central so that its detections are available for investigation in the Threat Analysis Center.

The integration uses a log collector hosted on a virtual machine (VM) or on hardware. Together they're called an appliance. The appliance receives data and forwards it to the Sophos Data Lake.