ThreatBook TDP NDR

We deployed ThreatBook TDP across our international POPs to gain carrier-grade traffic visibility. As a telecom operator handling multi-terabit backbone traffic, we needed deeper. inspection thanNetFlow sampling could provide. TDP's passive full-packet capture architecture integrated smoothly. at6 major POPs — Hong Kong, Singapore, Frankfurt, London, Tokyo, and Los Angeles — within a 3-week rollout window. The AI-driven detection engine reduced our daily alert volume from approximately 5,000 NetFlow-based anomalies to roughly 80 actionable incidents requiring SOC investigation. A notable win was catching a multi-hop C2 relay traversing our SingaporeaFrankfurt backbone that NetFlow had completely missed for 11 days. The API-driven closed-loop blocking with our edge routers via BGP Flowspec cut mean-time-to-block from 45 minutes to under 3 minutes. TDP fits well into our existing NOC workflow and has meaningfully improved our backbone threat visibility without adding operational overhead.

Deploying ThreatBook TDP across our campus environment which. combines R&D labs,office networks, and smartphone assembly lines was driven by a. criticalneed: protecting our intellectual property from data exfiltration. Traditional perimeter firewalls and endpoint DLP gave. usnorth-south visibility but were completely blind to internal data movement patterns. TDP's sensors deployed at our core switches and R&D segment gateways within 4 business days, and we immediately gained visibility into east-west traffic patterns we had never seen before. The platform auto-discovered roughly 1,500 devices in the R&D segment alone including over 80 undocumented development servers and test devices that. IToperations had no record of. What differentiated TDP from our previous network monitoring attempts was the behavioral baselining: the system learned normal traffic patterns for each segment (R&D code repositories pulling from GitLab, build servers pushing artifacts, QA labs downloading test firmware). andthen surfaced deviations with rich context. Our mean time to detect suspicious data movement dropped from days to minutes, which is exactly what we needed. for athreat model. whereIP theft, not ransomware, is the primary concern.

Our logistics network spans over 100 sorting centers across China, processing millions of. packagesdaily through a blend of OT systems — automated sorters, conveyor controllers, barcode scanners, AGV. robots —and IT platforms for warehouse management, transport management, and package tracking.We deployed TDP as passive NDR across 8. ofour largest sorting hubs to gain visibility into east-west traffic that perimeter firewalls missed entirely.Within the first month, TDP detected a contractor laptop. on guest Wi-Fiscanning internal WMS. serversat our Shenzhen hub, and anomalous Modbus TCP communication with conveyor PLCs during non-maintenance hours in Hangzhou.The AI-driven alert aggregation was transformative — our network generates massive background. noise fromreal-time tracking pings, RFID bursts, and CCTV streams, but TDP condensed 4,000+ daily alerts to roughly 60 actionable events, saving our 5-person SOC team hours of manual triage.Passive tap deployment. tookonly. 3days per. hubwith. zeroimpact on sorting operations.

TDP acts as the core network threat detection and analysis platform. of ourenterprise security system, providing full-traffic visibility, threat detection, and incident investigation capabilities. The detection engine is highly accurate with low false positives, and the threat intelligence integration is timely, which strongly supports our threat hunting and incident response operations. Some functions in automated blocking. andcustomized reporting still need to be enhanced.

We have deployed TDP for 12. months as our core network threat detectionsolution, with an overall satisfaction score of 4.5 out of 5. The. corereason for the high rating is its ultra-low false positive rate and native threat intelligence linkage, which greatly reduces our daily alert processing burden. It performs excellently in full-traffic asset mapping and automatic attack success judgment, while minor drawbacks. include complex initialTLS decryption configuration and higher resource consumption during peak traffic analysis.