Does network monitoring show which files an employee took?
No. A network sensor sees connections, not files. Most uploads today travel inside encrypted sessions, and NetSenX never decrypts traffic, so it cannot read file names or content. What it can show is that a particular device sent an unusual amount of data to a particular destination at a particular time, compared with that device's normal behaviour. That narrows the question: when, from which device and to where. To learn which files were involved, you need other sources: the cloud service's own audit logs, file-server access logs, endpoint tools or data-loss-prevention (DLP) software, each used within the limits of employment and data protection law. A copy to a USB stick or a printout never crosses the network at all.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Does network monitoring read employees' e-mails or messages?
- What does a network sensor record about employees?
- Do we need works council approval for network security monitoring?
- How do we see personal devices connected to the office network?
- Is it risky to let new employees use personal laptops on the company network?