# What does NetSenX see after someone clicks a phishing link?

NetSenX sees what the device does on the network afterwards, not the e-mail or the click itself. It does not read mail content and it does not decrypt traffic. What it can show, on every plan: a device that starts regular, timed connections to an outside server it never used before (beaconing); a device that starts scanning other machines; connections between internal hosts that point to lateral movement; and unusual volumes of data leaving the network. Where the agent captures packets, on Linux or through a mirror (SPAN) port, plans from Starter also show TLS fingerprints, which help pick out tools that do not match the device's usual software. Alerts name the MITRE ATT&CK technique, and from Starter they come with response recommendations. If the phishing only steals a cloud login that is then used from the attacker's own computer, none of that traffic touches your network, and your identity provider's sign-in logs are the place to look.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/what-does-netsenx-see-after-a-phishing-click

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [What is phishing?](https://netsenx.com/en/faq/what-is-phishing)
- [How can you tell that an e-mail is phishing?](https://netsenx.com/en/faq/how-to-spot-a-phishing-email)
- [I clicked a phishing link. What should I do now?](https://netsenx.com/en/faq/i-clicked-a-phishing-link-what-now)
- [I entered my work password on a phishing page. What now?](https://netsenx.com/en/faq/i-entered-my-work-password-on-a-phishing-page)
- [An employee entered their password on a phishing page. What should we check on the network?](https://netsenx.com/en/faq/employee-entered-password-what-to-check-on-the-network)