Arista NDR

Arista NDR is an AI-driven network detection and response platform built on AVA Sensors that monitors east-west and north-south traffic across data center, campus, IoT, and cloud workload networks. The platform analyzes over 3,000 protocols from Layer 2 through Layer 7 to detect threats without requiring traffic decryption, a capability that preserves encrypted traffic integrity in environments where decryption is prohibited by policy or impractical at the volumes involved. The EntityIQ engine builds behavioral models for every entity on the network and continuously updates those models as behavior changes.

AVA Sensors deploy in multiple form factors: built into Arista switches for zero-footprint deployment on existing hardware, or as standalone physical appliances, virtual machines, and cloud sensors in environments requiring dedicated capture capacity at high-traffic collection points. This flexibility allows NDR coverage to scale with the network without requiring new dedicated hardware at every monitoring point. Existing switch hardware provides sensor capacity where a switch is already present, with standalone sensors added only where additional capture capacity is needed.

Integrations with CrowdStrike Falcon Insight and SentinelOne close the loop between network detection and endpoint response: when NDR identifies a compromised endpoint based on network behavior, the integration allows an automated or analyst-initiated response to be executed on the endpoint through the partner EDR platform. Combined with Arista MSS, NDR provides the detection layer alongside MSS's prevention layer for a complete lateral movement containment architecture where detected threats can trigger automatic policy enforcement without manual intervention.