Network Detection and Response (NDR) is a new product category with an unexpectedly rich history. 'In this talk, Greg Bell will trace the open source heritage of NDR, explain its growing prominence in the 'sOC triad ' as a growing percentage of Internet hosts are unmanaged, and make the case for community models for network defense.