Does NetSenX record which files were exfiltrated?

No. NetSenX analyses flow metadata and a few protocol fields, and it never decrypts traffic. When data leaves through an encrypted connection, which is almost always the case, it sees which host sent how much, to which destination and when, but not the names or content of the files. That is still useful: it tells you which server to examine, how large the transfer was and when it happened, which is often enough to narrow down what could have been in it. To know which files were taken, combine it with sources that see files: audit logs of file servers and cloud storage, endpoint detection and response (EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine.) telemetry, data loss prevention tools, or a forensic examination of the server. If the attackers publish samples, those also indicate which folders were involved.

← All 60 questions on Incident responseAll topics