# What does a network sensor see of our cloud and SaaS traffic?

The connections between your devices and the cloud, not what happens inside the cloud. A sensor on the office network or an agent on a server sees which devices connect to which cloud and SaaS services, when, how often and how much data moves in each direction, plus the server name in the TLS handshake where packets are captured. That is enough to notice a laptop uploading gigabytes to a storage service it never used, a server checking in with a rented cloud machine every few minutes, or a device talking to an unexpected region. It does not see what users do inside a SaaS application, such as sharing a folder publicly, creating a forwarding rule or granting an app access to a mailbox; it does not see traffic between cloud services; and it does not see staff working from home on unmanaged devices. Those come from the provider's own audit logs and admin consoles. NetSenX covers the network side: beaconing, scanning, lateral movement and unusual outbound volume on every plan. It does not replace your cloud provider's logs.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/what-does-a-network-sensor-see-of-cloud-traffic

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [Can NetSenX monitor our servers in the cloud?](https://netsenx.com/en/faq/can-netsenx-monitor-our-cloud-servers)
- [How do I tell legitimate cloud traffic from an attacker's rented server?](https://netsenx.com/en/faq/how-to-tell-legitimate-cloud-traffic-from-an-attackers-server)
- [Which of our servers connect to cheap cloud hosting providers, and why?](https://netsenx.com/en/faq/why-do-our-servers-connect-to-cheap-cloud-hosting-providers)
- [Can attackers hide command-and-control inside trusted cloud services?](https://netsenx.com/en/faq/can-attackers-use-trusted-cloud-services-for-command-and-control)
- [How do we tell a legitimate cloud sync from data theft?](https://netsenx.com/en/faq/how-to-tell-a-cloud-sync-from-data-theft)