Stopping Threats in Their Tracks: Stellar Cyber’s NDR Latest Respond Capability Explained
In today’s modern SOC, speed matters. Threats evolve quickly, attackers move even faster, and security teams must be able to detect and respond before damage is done. While traditional Network Detection and Response (NDR) focuses on identifying suspicious behaviors, Stellar Cyber takes it a step further by giving customers the ability not only to detect – but to take action directly at the network level, all from the single platform without expensive add-on modules nor license.
One powerful capability enabling this is TCP RESET, a lightweight but highly effective method to both instantly disrupt malicious network sessions in progress and prevent future malicious ones from establishing. For organizations seeking faster response and reduced risk without additional burden of big expenses, Stellar Cyber’s NDR latest respond capability through TCP RESET delivers significant impact.
What Is TCP RESET and Why Does It Matter?
In TCP/IP networking, a TCP Reset is a control flag used to immediately terminate a connection. When a TCP RESET packet is injected into an active session, communication between the two endpoints stops instantly, without waiting for normal TCP teardown. TCP RESET can also prevent new connections from establishing during the initial 3-way handshaking of a TCP connection.
In security operations, this simple action has tremendous value. If a malicious actor is:
- Exfiltrating data
- Running a command-and-control (C2) session
- Scanning internal assets
- Trying to exploit a vulnerability of an application or a device
- Brute-forcing authentication services
An immediate TCP RESET allows the defender to cut the connection before damage occurs or prevent future connections from being established, without relying on heavy or complex network controls.
How Stellar Cyber Implements TCP RESET
Stellar Cyber’s NDR platform monitors network traffic in real time and correlates behaviors with threat detection models. When a malicious or suspicious session is identified, the platform can issue a TCP Reset signal to shut down the offending flow.
This is done at the sensor where it can see the TCP connections in real-time, without requiring additional hardware or changes to existing infrastructure. It integrates seamlessly into detection workflows and enriches an organization’s overall response capabilities.
This enables Stellar Cyber to disrupt malicious connections as soon as it detects a threat.
The following are a few cases where quickly terminating the TCP connection reduces harm:
-
Exploit attempts with high-confidence signatures Example:
If Stellar Cyber detects clear IDS/IPS signatures for protocol exploits, such as an HTTP request that matches a known remote-code-execution exploit, terminating the connection prevents the delivery of an exploit payload or code execution staging. -
Confirmed Command-and-Control (C2) callbacks Example:
If Stellar Cyber detects small, regular beaconing to known-malicious IP addresses or domain names or to a destination proven to be C2 server, preventing the TCP connection from establishing disrupts the attacker’s control channel. -
Active data-exfiltration over TCP with DLP match Example:
If there’s a file transfer where Data Loss Prevention (DLP) rules match sensitive data being sent to an external host, immediately terminating the TCP connection limits data loss.
Key Benefits for Stellar Cyber Customers
1. Built In - Not Bolted On
Stellar Cyber delivers full NDR capability directly within the Open XDR platform, eliminating the need for another standalone, high-cost NDR product. SOC analysts get advanced network detection and response as part of a unified workflow – no additional tools, no extra licensing, no integration overhead.
2. Where Instant TCP Reset Disruption Makes the Difference
Inline TCP Reset provides precision interruption exactly when control and timing matter most. Security teams rely on it to strengthen their defensive posture across several critical scenarios:
-
Data Exfiltration
Prevention When attackers attempt to move sensitive data - during ransomware staging or targeted espionage - every second matters. TCP Reset cuts the session mid-stream, instantly halting the transfer before any data leaves the perimeter. -
Command-and-Control (C2) Disruption
Modern threats depend on interactive C2 channels for execution, payload delivery, and lateral movement. By severing that connection, TCP Reset denies attackers the ability to operate in real time, giving defenders the upper hand. -
Internal Reconnaissance Containment
Early-stage activities like scanning or enumeration can be quietly interrupted. TCP Reset limits adversary visibility without triggering evasive behavior, allowing analysts to monitor without escalating the threat. -
Authentication Brute-Force Throttling
High-volume login attempts indicate credential stuffing or brute force activity. Instead of relying on static rate limits, TCP Reset dynamically terminates abusive sessions in real time. -
Zero-Day Exploit Defense
Even before patches exist, exploit attempts reveal themselves through anomalous payloads or scanning behavior. TCP Reset enables defenders to act on behavior - not signatures - by disrupting malicious sessions instantly. -
Insider Threat Mitigation
When a legitimate user or compromised account begins acting suspiciously - file transfers, probing restricted zones, or unusual access patterns - inline disruption provides fast, targeted containment without affecting normal operations.
3. Lightweight Response Without Network Impact
4. Accelerated SOC Response and Higher Efficiency
- Automatically trigger resets for high-confidence alerts
- Execute manual resets during analyst-driven investigations
- Incorporate the action into Playbooks and Response Apps
5. Enhances Existing Security Controls
- If an attacker evades EDR, TCP Reset still terminates their active session.
- If a firewall cannot detect behavioral anomalies, Stellar Cyber’s NDR analytics can still stop the connection.
6. A Powerful Tool for Incident Containment
- Stop suspicious sessions or applications without isolating an entire host
- Limit attacker movement while gathering evidence
- Contain live threats without interrupting business operations
“TCP Reset is just the beginning. At Stellar Cyber, we’re continuing to expand inline response capabilities that give defenders surgical control over network traffic – without introducing complexity. Expect more agentless, high-speed response features that empower SOC teams to act at machine speed, not after the fact.”
“We were able to quickly implement the TCP RESET respond capability, since NDR is natively built into the Stellar Cyber XDR platform,” said Airton Coelho, CTO at Future Technologies, “and we observed the immediate interruption of ongoing data exfiltration attempts and the blocking of command‑and‑control (C2) sessions in environments without EDR. This allowed us to contain advanced and zero‑day threats directly at the network layer, without agents on the endpoints, all at a fraction of the cost compared to using a dedicated NDR tool. This is an incredible feature, as it offers a solution to quickly stop threats in critical environments, such as OT/ICS, which do not have EDR.”
Conclusion: Machine-Speed Response That Stops Threats in Their Tracks
- Reduce risk
- Improve response times
- Enhance SOC efficiency
- Contain incidents without disrupting business
