ExeonTrace NDR

Cyberattacks such as ransomware, fraud, credential theft, and data leaks are now routine, pushing IT teams to deploy many specialized security tools. Network Detection & Response (NDR) is positioned as a next-generation evolution of intrusion detection: it uses multiple machine learning techniques to establish baselines and identify anomalous traffic, addressing historical IDS drawbacks like labor intensity and high false-positive rates. NDR is presented as particularly valuable for uncovering unknown compromises and tracing attacker behavior that often includes lateral movement, privileged credential misuse, and data exfiltration. It also provides visibility in OT/ICS/IIoT environments where endpoint agents may be impractical, especially at network segmentation control points.

Exeon Analytics (founded 2016 in Switzerland) offers ExeonTrace, derived from ETH Zurich research, with three modules (network, web, and extended logs) licensed by active IPs and modules used. It is deployed on-premises or in private clouds only, as a Linux-based virtual appliance that passively receives telemetry (e.g., NetFlow/IPFIX, DNS, firewall, syslog, SWG logs, and varied “XLog” sources like Active Directory, VPN gateways, IDS, and EPDR). ExeonTrace analyzes flow metadata rather than packets, enabling detection even when traffic is encrypted, but it does not perform packet capture or deep packet inspection. The product combines static rules with proprietary supervised and unsupervised ML models, supports customization of detections with professional services, and typically requires two weeks or less for baselining and sensitivity tuning across different network zones. It correlates events into cases, supports threat hunting and integrations (MISP, STIX/TAXII, YARA), and exports alerts via email/APIs and multiple formats for SIEM/SOAR interoperability, though response playbooks and in-platform report creation are limited.

• Network Detection & Response tools use machine learning to identify baselines and anomalous traffic rather than relying only on static rules or IDS signatures.
• Advanced Persistent Threat actors often seek long-term presence for intelligence collection, intellectual property theft, or sabotage.
• NDR tools can be deployed in OT/ICS/IIoT environments where endpoint agents may not be feasible.
• Exeon Analytics was founded in 2016 in Switzerland.
• ExeonTrace originated from research conducted at the Swiss Federal Institute of Technology in Zurich.
• ExeonTrace is deployed on-premises or in private clouds and has no public cloud-hosted components.
• ExeonTrace is deployed as a Linux-based virtual appliance and passively receives telemetry rather than capturing packets.
• ExeonTrace cannot perform deep packet inspection and cannot capture packets.
• Baselining and configuring sensitivity levels typically takes two weeks or less.
• ExeonTrace stores event metadata rather than full packet content to reduce long-term storage cost.

• “NDR tools are effectively ‘Next-Generation Intrusion Detection Systems’ (IDS).”
• “Given the volumes of network connection data that must be analyzed, using ML algorithms and models is a ‘must’ rather than a ‘nice-to-have’.”
• “Their goals often require long-term presence on victims’ properties, hence the use of the term ‘persistent’.”
• “Proper design of NDR deployments is necessary to monitor all traffic flows.”
• “At a high level, unsupervised ML finds outliers or anomalies in traffic patterns; while supervised ML models categorize possible threats among the outliers, classify malicious activities, domains, and other attributes.”
• “ExeonTrace is a passive receiver of telemetry from network and other devices.”
• “ExeonTrace looks at flow metadata only, which works even if the traffic is encrypted.”
• “Customers work with professional services to put the proper models in place, baseline their environments, and set sensitivity levels for different areas within their environments.”
• “Playbooks are not present, but customers can script in alert conditions.”
• “The management and analyst interfaces are intuitive and can yield important insights for customers.”