What three components feed their events into NDR?

VMware vDefend Network Detection and Response (NDR) acts as the centralized "brain" of the Advanced Threat Prevention (ATP) suite. It does not generate alerts on its own; instead, it relies on telemetry and events generated by three primary sensory engines:

NTA (Network Traffic Analysis): Feeds behavioral anomalies (like unusual port scans, DGA algorithms, or anomalous data transfers).

Anti-Malware / Malware Prevention: Feeds events regarding suspicious file transfers, file extractions, and malicious sandbox detonations.

IDPS (Intrusion Detection and Prevention System): Feeds signature-based alerts of known exploit attempts (like SQL injections or known vulnerable protocol abuse).

The NDR engine ingests these isolated events and uses AI to correlate them, determining if a standalone malware alert and a standalone NTA alert are actually part of the same coordinated attack campaign.

=========================