> For the complete documentation index, see [llms.txt](https://cybrhawksoc.gitbook.io/cybrhawk-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybrhawksoc.gitbook.io/cybrhawk-docs/appliances/network-sensor/overview.md).

# Overview

## Overview

The CybrHawk Network Detection and Response (NDR) Sensor is available in two deployment options:

* [Physical Sensor](/cybrhawk-docs/appliances/network-sensor/physical-sensor.md): High-performance hardware appliances designed for large enterprise or data-center environments.
* [Virtual Sensor](/cybrhawk-docs/appliances/network-sensor/virtual-sensor.md): Software-based appliances suitable for smaller deployments and cloud-only environments.

Both types provide passive monitoring of network traffic to deliver visibility, intrusion detection, and behavioral analytics for the CybrHawk SecOps platform.

***

## Deployment

The NDR Sensor is a **passive device** that monitors a copy of production traffic.\
The recommended deployment location is where **North-South traffic** (internal ↔ external) passes through your environment, typically on the internal firewall interface.

To achieve this, configure a **SPAN (port mirroring)** session on your switch or firewall to forward traffic to the NDR sensor.

***

## Deployment Diagram

![Network Sensor Deployment](/files/eBRYKVn082Iybt0ZrKcs)<br>

*Example:* *span port configuration feeding mirrored traffic to a CybrHawk sensor.*

***

## Example: Cisco Switch Port Mirroring

For a typical Cisco switch, where the internal firewall is connected on the port `eth0/1` and the CybrHawk sensor is connected to the port `eth0/2`, the configuration would be:

```
monitor session 1 source interface eth0/1
monitor session 1 destination interface eth0/2
```

This configuration:

* Creates monitoring session **1**.
* Forwards traffic from the **source** interface (firewall port).
* Mirrors traffic to the **destination** interface (sensor port).

> **Note:** Interface notation (e.g., `eth0/1`) may vary depending on the switch model and configuration.

***

## Outbound Connectivity Requirements

For the NDR Sensor to operate correctly, outbound HTTPS access is required for updates and threat intelligence feeds.

* **Protocol / Port**: TCP/443 (HTTPS)
* **Purpose**: OS updates, CybrHawk Threat Intelligence feeds
* **Proxy Support**: Ensure proxy settings are configured to allow SSL/TLS inspection if required.