# Can we see which program on a server made a large upload?

Not from the network alone. A network sensor sees which host sent how much, to where and when, and sometimes the protocol and server name; the program that opened the connection is known only on the host itself. To get it, use endpoint detection and response (EDR) or the operating system's own connection logging on important servers, and record process and network events together so that a transfer can be matched to its process afterwards. Firewalls and proxies that authenticate users can add the account. In practice the network alert tells you which server and which minute to look at, which makes finding the process quick. NetSenX flags unusual outbound data volume per host, with time and destination, on every plan; it does not name the process or the user behind it.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/can-we-see-which-program-made-a-large-upload

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is a supply chain attack?](https://netsenx.com/en/faq/what-is-a-supply-chain-attack)
- [What is a zero-day, and can anything detect it?](https://netsenx.com/en/faq/what-is-a-zero-day-and-can-it-be-detected)
- [What is the difference between brute force and password spraying?](https://netsenx.com/en/faq/difference-between-brute-force-and-password-spraying)
- [What is credential stuffing?](https://netsenx.com/en/faq/what-is-credential-stuffing)
- [What is Kerberoasting?](https://netsenx.com/en/faq/what-is-kerberoasting)