Can network monitoring see attacks on accounts and the directory?

Partly, and NetSenX less than you might expect. Many identity attacks happen inside sign-in systems: password spraying against cloud accounts, phishing of MFA codes, stolen session tokens and abuse of directory permissions. Those leave traces in identity provider, directory and cloud logs, not on your office network, so the tools that read those logs, such as the identity provider's risk detection, an EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. or a SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them., are where they are caught. Some directory attacks do cross the network, such as one workstation suddenly requesting many service tickets from the domain controller, and specialist tools watch those protocols. NetSenX does not raise alerts on identity events. What it sees is the device behaviour around them: repeated login attempts against monitored hosts as brute force, and the lateral movement, scanning and beaconing that follow a compromised account, on every plan. Use it beside your identity logs, not instead of them.

← All 45 questions on Zero trust, identity and segmentationAll topics