# How do we know what normal looks like on our network?

By recording it before you need it. Normal is a description of who talks to whom, when and how much: which servers each workstation uses, which outside services it reaches, when backups run, which devices stay quiet at night. Most small companies have never written this down, which is why an odd connection is hard to judge in the middle of an incident. Start with a simple list of your servers, scheduled jobs, remote-access tools and the suppliers who connect in. Firewall and DNS logs from an ordinary week give you a first picture. NetSenX learns each host's normal from the traffic on the segments it monitors and compares every new connection with it, and its network map, on every plan, shows who talks to whom. A newly installed sensor needs time with your own traffic before its view of normal is reliable, and NetSenX tells you when it does not yet have enough data.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/how-do-we-know-what-normal-looks-like-on-our-network

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [What is an indicator of compromise (IOC)?](https://netsenx.com/en/faq/what-is-an-indicator-of-compromise)
- [Our antivirus shows everything green. Can we still be compromised?](https://netsenx.com/en/faq/antivirus-shows-green-can-we-still-be-compromised)
- [An administrator account appeared that nobody remembers creating. What now?](https://netsenx.com/en/faq/an-administrator-account-appeared-that-nobody-created)
- [A server sends data out at night. What should we check?](https://netsenx.com/en/faq/a-server-sends-data-out-at-night-what-to-check)
- [Our public IP address is on a blocklist. Does that mean we have been hacked?](https://netsenx.com/en/faq/our-ip-address-is-on-a-blocklist-are-we-hacked)