# Can NDR see cloud and SaaS traffic?

Partly: it sees your devices' connections to cloud and SaaS services, not what happens inside those services. From the office network, NDR (network detection and response) can see which hosts connect to which cloud providers, how often and how much data they send, so a server uploading a large archive to an unknown storage account at night stands out. What it cannot see is activity inside the SaaS application itself: a mailbox rule created in your e-mail service, a file shared publicly from a cloud drive, or a login from a stolen password in another country. Those live in the provider's audit and sign-in logs, which you should switch on and review. Traffic from laptops at home that never crosses your network is also out of view unless an agent runs on them. NetSenX shows cloud destinations in a review queue on the network map on every plan, and unusual outbound volume as an alert.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/can-ndr-see-cloud-and-saas-traffic

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [Can NDR block attacks or only alert?](https://netsenx.com/en/faq/can-ndr-block-attacks-or-only-alert)
- [How do I build an asset inventory from network traffic?](https://netsenx.com/en/faq/how-to-build-an-asset-inventory-from-network-traffic)
- [Does a network map show devices that never send any traffic?](https://netsenx.com/en/faq/does-a-network-map-show-devices-that-never-send-traffic)
- [Is NDR worth it for a small or mid-sized company?](https://netsenx.com/en/faq/is-ndr-worth-it-for-a-small-or-mid-sized-company)
- [What should I ask when evaluating an NDR product?](https://netsenx.com/en/faq/what-to-ask-when-evaluating-an-ndr-product)