Can NetSenX monitor our servers in the cloud?
Partly: it sees the network behaviour of Linux servers that carry its agent, wherever they run, but it does not read your cloud provider's control plane. The NetSenX agent runs on Linux and macOS, so a Linux virtual server you operate at a cloud provider can carry it like any other Linux machine; the agent then sees that server's own connections, and the core detections apply on every plan: beaconing to a command-and-control server, scanning, lateral movement to other servers, and unusual outbound data volume. Each such server counts as a device on your plan. What stays outside: managed services you do not run yourself, such as databases, serverless functions and storage; traffic between cloud services that never touches a server with the agent; and everything in the provider's management layer, such as account sign-ins, permission changes and configuration. For those, switch on the provider's own audit and flow logs and send them where someone reviews them. Combining both views gives you the network behaviour of your servers and the account activity around them.
Read next
Related questions
- How do I tell legitimate cloud traffic from an attacker's rented server?
- Which of our servers connect to cheap cloud hosting providers, and why?
- Can attackers hide command-and-control inside trusted cloud services?
- How do we tell a legitimate cloud sync from data theft?
- Can we see if a leaving employee uploads company data to the cloud?