How do we tell a network attack from a heavy update or backup?
By asking who, where and when, and comparing the answer with normal. A backup moves data from known hosts to a known destination, usually at a fixed time, with a similar volume every night. An update downloads to many hosts from the vendor's servers in a short burst. Theft looks different: a host that rarely uploads sending a lot, to a destination nobody else uses, at an hour when it is normally quiet, or a workstation suddenly reading many file shares. Keep a short list of your scheduled jobs, their hosts and their times, so that anyone can check an alert against it. NetSenX judges each host against its own normal destinations, volumes and times of day, explains on every alert which network features drove it, and lets you mark an alert as a false positive, with the decision kept in the audit log.