What does network detection miss if a segment is not mirrored?

Everything that happens only inside that segment. A sensor sees the traffic it receives; if a switch port is not mirrored to it and no agent runs on the hosts there, connections between devices on that segment, such as an attacker moving from a PC to a file server next to it, stay invisible. You may still see traffic that leaves the segment through a monitored point, for example to the internet or to another site, but the internal steps of an intrusion are often exactly what you need. Decide by risk: mirror the segments with servers, administration, finance, HR and production first, then the rest. Where mirroring is impractical, run the agent on the important hosts themselves. NetSenX shows which segments its sensors and agents watch, so the gaps are visible.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics