What does a network sensor actually collect: content or metadata?

It depends on the product, and you should ask. Some sensors record full traffic for later analysis; others keep only connection records. NetSenX analyses connection metadata and a few protocol fields: timing, volume, source and destination, ports, DNS answers and, where the agent captures packets, the unencrypted parts of the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake. It never decrypts traffic, so the content of encrypted sessions, such as e-mails, files or what someone typed into a website, stays unreadable. That is enough to see behaviour like beaconing, scanning, lateral movement and unusual uploads, and it limits how much personal data the tool handles. Network metadata can still relate to people, so check it with your data protection officer and read the vendor's data processing agreement.

← All 40 questions on Small business monitoringAll topics