# How do we tell a network attack from a heavy update or backup?

By asking who, where and when, and comparing the answer with normal. A backup moves data from known hosts to a known destination, usually at a fixed time, with a similar volume every night. An update downloads to many hosts from the vendor's servers in a short burst. Theft looks different: a host that rarely uploads sending a lot, to a destination nobody else uses, at an hour when it is normally quiet, or a workstation suddenly reading many file shares. Keep a short list of your scheduled jobs, their hosts and their times, so that anyone can check an alert against it. NetSenX judges each host against its own normal destinations, volumes and times of day, explains on every alert which network features drove it, and lets you mark an alert as a false positive, with the decision kept in the audit log.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/how-to-tell-a-network-attack-from-an-update-or-backup

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [How do we know what normal looks like on our network?](https://netsenx.com/en/faq/how-do-we-know-what-normal-looks-like-on-our-network)
- [What is an indicator of compromise (IOC)?](https://netsenx.com/en/faq/what-is-an-indicator-of-compromise)
- [Our antivirus shows everything green. Can we still be compromised?](https://netsenx.com/en/faq/antivirus-shows-green-can-we-still-be-compromised)
- [An administrator account appeared that nobody remembers creating. What now?](https://netsenx.com/en/faq/an-administrator-account-appeared-that-nobody-created)
- [A server sends data out at night. What should we check?](https://netsenx.com/en/faq/a-server-sends-data-out-at-night-what-to-check)