Darktrace NDR

Connect Darktrace NDR to Radiant Security to forward AI Analyst and Model Breach alerts for AI triage.

Darktrace NDR is a network detection and response platform that uses self-learning AI to identify anomalous behavior, lateral movement, and emerging threats across on-premises, cloud, and hybrid networks. Connecting Darktrace NDR forwards AI Analyst alerts, Model Breach alerts, and system status alerts to Radiant Security via syslog through a Radiant Agent. Radiant uses these alerts during the Enrichment stage to correlate network anomalies with other telemetry.

Prerequisites

• Admin access to Darktrace
• A deployed Radiant Agent reachable from the Darktrace appliance

Add the data connector in Radiant Security

1. Log in to Radiant Security.
2. From the navigation menu, click Settings > Data Connectors, then click + Add Connector.
3. Search for and select Radiant Agent, then click Data Feeds.
4. Under Select your data feeds, select Darktrace NDR, then click Credentials.
5. Under Credential Name, enter an identifiable name for the Radiant Agent integration (e.g., Radiant Agent integration). To reuse an existing Radiant Agent credential, select it from the drop-down menu.
6. Click Add Connector.

Configure Darktrace NDR to forward syslog

Before starting, confirm the IP address of the Radiant Agent and the port configured to receive Darktrace NDR data. If you do not know the port, contact your Customer Success representative.

1. Log in to the Darktrace Console.
2. Navigate to the Admin panel.
3. Under System Configuration, navigate to Modules > Darktrace/Cloud.

1. Under Workflow Integrations, click Syslog.
2. Click the Syslog JSON tab.
3. Enter the following values:

   • Send Alerts: Enabled
   • Server: the IP address of the Radiant Agent
   • Server Port: the port configured on the Radiant Agent to receive Darktrace NDR data
   • Use Application Name: Enabled
   • Application Name: darktrace
   • Send AI Analyst Alerts: Enabled
   • AI Analyst Behavior Filter: Compliance, Critical, Suspicious
   • Send Model Breach Alerts: Enabled
   • Model Breach Behavior Filter: Compliance, Critical, Suspicious
   • Send System Status Alerts: Enabled
   • Send Resolved System Status Alerts: Enabled
   • Minimum System Status Priority: High
   • Master: All
4. At the top of the Syslog Workflow Integration window, toggle on the Enabled button.
5. Click Save.

Verify ingestion

After Darktrace NDR begins forwarding, confirm alerts are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"darktrace_ndr".
3. Confirm recent alerts appear.

Allow several minutes for alerts to be parsed, indexed, and available for search.