# How would we know if our ERP database was copied out of the company?

By looking at what the database server sent out, not at the database itself. An ERP export of customers, prices or payroll is large, and the server it lives on normally talks to the ERP application, the backup system and a few users, not to the internet. Signs are a large outbound transfer from that server, or from a workstation that has just pulled a big export, especially at night or to cloud storage; a database dump file appearing on a file share; or a new remote session to the server shortly before. Restrict internet access from database servers and log exports in the ERP itself. NetSenX flags unusual outbound data volume per host, with destination and time, on every plan; it does not see which tables were inside an encrypted transfer.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/how-would-we-know-if-our-erp-database-was-copied-out

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Can network monitoring tell a backup upload from data theft?](https://netsenx.com/en/faq/can-network-monitoring-tell-a-backup-from-data-theft)
- [Why would a normal workstation connect to the domain controller at night?](https://netsenx.com/en/faq/why-would-a-workstation-connect-to-the-domain-controller-at-night)
- [What is ARP spoofing, and how do we detect it on a small office network?](https://netsenx.com/en/faq/what-is-arp-spoofing-and-how-to-detect-it)
- [Can someone on our Wi-Fi read other users' traffic?](https://netsenx.com/en/faq/can-someone-on-our-wi-fi-read-other-users-traffic)
- [How much time do we have once ransomware starts touching file shares?](https://netsenx.com/en/faq/how-much-time-once-ransomware-touches-file-shares)