How long should we watch the network closely after an incident?
At least several weeks, and longer after a serious intrusion. Attackers who kept a foothold often wait until the response team relaxes, and access sold to others may be used much later. During this period, review alerts daily, look for connections to the indicators from your investigation, check for new administrator accounts and remote-access tools, and confirm that backups keep running and are not being touched by unusual hosts. Treat any repeat of the original pattern as a new incident, not as noise. Decide in advance who reviews what, and when the heightened watch ends. NetSenX flags beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included, and its alert history, 30 days on Free and longer on paid plans, lets you compare the weeks after the incident with the weeks before.