What does a network sensor see of our cloud and SaaS traffic?
The connections between your devices and the cloud, not what happens inside the cloud. A sensor on the office network or an agent on a server sees which devices connect to which cloud and SaaS services, when, how often and how much data moves in each direction, plus the server name in the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake where packets are captured. That is enough to notice a laptop uploading gigabytes to a storage service it never used, a server checking in with a rented cloud machine every few minutes, or a device talking to an unexpected region. It does not see what users do inside a SaaS application, such as sharing a folder publicly, creating a forwarding rule or granting an app access to a mailbox; it does not see traffic between cloud services; and it does not see staff working from home on unmanaged devices. Those come from the provider's own audit logs and admin consoles. NetSenX covers the network side: beaconing, scanning, lateral movement and unusual outbound volume on every plan. It does not replace your cloud provider's logs.
Read next
Related questions
- Can NetSenX monitor our servers in the cloud?
- How do I tell legitimate cloud traffic from an attacker's rented server?
- Which of our servers connect to cheap cloud hosting providers, and why?
- Can attackers hide command-and-control inside trusted cloud services?
- How do we tell a legitimate cloud sync from data theft?
Terms used here
- TLS (Transport Layer Security)
- The encryption that protects most internet traffic, such as HTTPS.