Should we detect lateral movement from authentication logs or from network flows?

Both, because each sees what the other misses. Authentication logs from the directory, servers and VPN show which account logged in where, with what method and whether it failed; they are the best source for stolen credentials, but only for systems that log, keep the logs and send them somewhere you read. Network flows show which host connected to which, on which port, how often and how much, for every device on a monitored segment, including those that keep no logs: printers, appliances, unmanaged servers. They do not show account names. In practice, a new session between two hosts that never talked is a network signal, and the account behind it is an identity question. NetSenX covers the network side on every plan; pair it with your directory's sign-in logs or a SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them., to which NetSenX can export from the Business plan.

← All 69 questions on Attack techniques explainedAll topics