# Can network monitoring see attacks on accounts and the directory?

Partly, and NetSenX less than you might expect. Many identity attacks happen inside sign-in systems: password spraying against cloud accounts, phishing of MFA codes, stolen session tokens and abuse of directory permissions. Those leave traces in identity provider, directory and cloud logs, not on your office network, so the tools that read those logs, such as the identity provider's risk detection, an EDR or a SIEM, are where they are caught. Some directory attacks do cross the network, such as one workstation suddenly requesting many service tickets from the domain controller, and specialist tools watch those protocols. NetSenX does not raise alerts on identity events. What it sees is the device behaviour around them: repeated login attempts against monitored hosts as brute force, and the lateral movement, scanning and beaconing that follow a compromised account, on every plan. Use it beside your identity logs, not instead of them.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/can-network-monitoring-see-identity-attacks

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Does NIS2 require zero trust?](https://netsenx.com/en/faq/does-nis2-require-zero-trust)
- [How do we limit what a compromised laptop can reach?](https://netsenx.com/en/faq/how-to-limit-what-a-compromised-laptop-can-reach)
- [Should our servers be allowed to connect to any address on the internet?](https://netsenx.com/en/faq/should-servers-be-allowed-to-browse-the-internet)
- [How do we write segmentation rules without breaking things?](https://netsenx.com/en/faq/how-to-build-allow-rules-from-real-traffic)
- [Is a DMZ still useful for a small company?](https://netsenx.com/en/faq/is-a-dmz-still-useful)