# Should we detect lateral movement from authentication logs or from network flows?

Both, because each sees what the other misses. Authentication logs from the directory, servers and VPN show which account logged in where, with what method and whether it failed; they are the best source for stolen credentials, but only for systems that log, keep the logs and send them somewhere you read. Network flows show which host connected to which, on which port, how often and how much, for every device on a monitored segment, including those that keep no logs: printers, appliances, unmanaged servers. They do not show account names. In practice, a new session between two hosts that never talked is a network signal, and the account behind it is an identity question. NetSenX covers the network side on every plan; pair it with your directory's sign-in logs or a SIEM, to which NetSenX can export from the Business plan.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/authentication-logs-or-network-flows-for-lateral-movement

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is graph-based detection of lateral movement?](https://netsenx.com/en/faq/what-is-graph-based-lateral-movement-detection)
- [Do rule-based security tools miss new attack paths?](https://netsenx.com/en/faq/do-rule-based-tools-miss-new-attack-paths)
- [Why would a printer scan our network, and can printers be used to attack other computers?](https://netsenx.com/en/faq/why-would-a-printer-scan-our-network)
- [How do we stop an attacker who is already in our network?](https://netsenx.com/en/faq/how-to-stop-an-attacker-already-in-our-network)
- [How fast do attackers move once they are inside?](https://netsenx.com/en/faq/how-fast-do-attackers-move-once-inside)