How do we spot activity on a computer that should be idle?
By comparing what it does now with what it normally does. A computer that should be idle, because its user is on leave or it is only switched on for updates, has a very small normal pattern: a few update servers, perhaps the backup system. Anything beyond that, such as regular connections to an unknown outside server, logins to other internal machines, scanning or large uploads at night, is a strong signal. On every plan, NetSenX learns each device's own normal destinations, volumes and times of day, and raises alerts for beaconing, scanning, lateral movement and unusual outbound data volume, with the device, destination and time. It cannot see what happens inside the machine without network traffic; endpoint protection covers that. Write down which machines should be idle, so a stand-in knows.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What should IT do with the computers of employees on long-term leave?
- How do we monitor contractors' laptops on our network?
- Should contractors get a separate network?
- Can we see when a contractor's laptop stops connecting after the project ends?
- Can network monitoring detect data copied to a USB stick?