What is the difference between a firewall and an NDR?

A firewall controls the traffic that crosses the perimeter or moves between segments, and applies allow or block rules. An NDR analyzes traffic behavior, including internal traffic, to detect anomalies such as lateral movement or malware beacons. It is common to have both.

Is it safe to block IP addresses automatically?

Within limits. It works well for high-confidence indicators with an expiry date, such as a confirmed command-and-control IP. For shared IPs, CDNs or cloud services, human validation is advisable, because a wrong block can take your company's services offline.

Does encrypted traffic prevent threat detection on the network?

It limits what you can see, but it doesn't eliminate it. Without decryption, the network still sees destinations, volumes, timing and TLS client fingerprints such as JA3 or JA4, which are enough to detect beacons or exfiltration. Decryption at the proxy or firewall adds visibility, at a cost in performance and privacy.

Do I need a SIEM to integrate firewall logs?

Not necessarily. Ciberia can integrate directly with the firewall or, if you already have a SIEM that centralizes its events, work on top of it and make use of its history.

Firewall and NDR integration: Palo Alto, Fortinet, Cisco

What does the network see that EDR and identity don't?

Everything crosses the network, with or without an agent: printers, cameras, industrial systems, personal laptops on the guest Wi-Fi and the perimeter devices themselves. Mandiant's M-Trends 2026 report describes espionage groups that deliberately target network devices, such as VPNs and routers, which typically lack EDR telemetry, and that use the device's own packet capture to intercept data and credentials in cleartext.

The way in is often there too. According to Verizon's 2026 Data Breach Investigations Report, 31% of breaches start with the exploitation of software vulnerabilities, ahead of stolen credentials. Many of those vulnerabilities are in internet-facing services and devices, and exploiting them leaves traces in the traffic.

What signals does each network tool provide?

Tool	Signals it provides	Examples
Next-generation firewall	Allowed and blocked connections, IPS detections, identified applications, VPN access.	Palo Alto Networks, Fortinet FortiGate, Cisco Firepower, Check Point, Sophos
Proxy and cloud web security	URLs visited per user, categories, downloads and upload volume per destination.	Zscaler, Netskope, Prisma Access
DNS and domain filtering	Queries to domains that are newly registered, algorithmically generated or used to tunnel data.	Cisco Umbrella, Infoblox
NDR	Internal traffic behavior, periodic beacons, scans and anomalous transfers.	Darktrace, Vectra AI, ExtraHop, Cisco Secure Network Analytics
WAF and CDN	Attacks on web applications, bots and request spikes.	Cloudflare, Akamai, Imperva, F5

What attacks can network signals detect?

Command and control: regular connections, with constant size and timing, to an uncommon domain or IP address.
Exfiltration: unusually large uploads to cloud storage, FTP or never-before-used destinations, often outside business hours.
Lateral movement: a workstation that starts connecting to many servers over SMB, RDP or WinRM.
Exploitation of exposed services: IPS signatures against the VPN or firewall followed by outbound connections from the device itself.
DNS tunneling and algorithmically generated domains, typical of some malware families.
Anomalous VPN access: the same account connected from two countries, or outside the person's usual pattern.

What response can be orchestrated on the network?

The most common action is to block an indicator at the right control point. Depending on the tool:

Block an IP address on the firewall, usually by adding it to a list that an existing deny rule already checks.
Block a domain or URL on the proxy, DNS filter or web gateway so no one can resolve or visit it.
Terminate a VPN session or force the user to re-authenticate.
Apply a mitigation rule on the WAF or CDN in response to an attack on an application.
On NDRs that include response, restrict a device's connections to its normal behavior.

How does it differ from integrating the EDR?

The EDR acts inside the device and the network acts on traffic. Isolating a device affects one machine; blocking a domain affects the whole organization and also protects devices without an agent. They complement each other: the network often gives the first clue, an odd connection, and the EDR explains which process generated it.

What should you check on your network?

Logging of allowed traffic, threats and VPN access, not just blocks.
An inventory of your internet egress points (offices, VPN, cloud) so you know which traffic doesn't go through the firewall.
Time synchronization (NTP) on every device, essential for correlating with the endpoint.

How Ciberia helps

Ciberia MDR integrates with your firewall, proxy, DNS or NDR, and its AI agents correlate their events with endpoint, identity and cloud. Ciberia Intel adds context to every connection with information on actors, campaigns and IOCs, and Threat Hunting findings on lateral movement become new detection rules. When the decision is to block, the AI proposes it, an analyst validates actions with impact, and blocking the IP address or domain is orchestrated according to the tool, with the action logged. 24/7 coverage, without replacing your firewall or your SIEM.

Firewall and network integration: Palo Alto Networks, Fortinet, Cisco, Zscaler, Darktrace and more