Your M395 handles the block-or-allow stuff. NDR is what happens after — it watches actual traffic patterns and flags the weird stuff before it turns into a 7am 'why is our network down' call. Two years of that coverage, no mid-term renewal to lose track of. If you've got the M395 running and want the detection layer to match, this is the subscription that does it
| brand | WatchGuard |
| model_compatibility | Firebox M395 |
| term | 2 Year |
| category | Network – Security UTM |
| subcategory | Managed Detection & Response (MDR) |
| service_type | NDR Subscription |
