How do we know what normal looks like on our network?

By recording it before you need it. Normal is a description of who talks to whom, when and how much: which servers each workstation uses, which outside services it reaches, when backups run, which devices stay quiet at night. Most small companies have never written this down, which is why an odd connection is hard to judge in the middle of an incident. Start with a simple list of your servers, scheduled jobs, remote-access tools and the suppliers who connect in. Firewall and DNS logs from an ordinary week give you a first picture. NetSenX learns each host's normal from the traffic on the segments it monitors and compares every new connection with it, and its network map, on every plan, shows who talks to whom. A newly installed sensor needs time with your own traffic before its view of normal is reliable, and NetSenX tells you when it does not yet have enough data.

This answer also appears, with more context, here: Have I been hacked?

← All 35 questions on Have I been hacked?All topics