# Why do update agents and monitoring tools look like beaconing?

Because they behave the same way: they contact a server at regular intervals, day and night, to check for updates, report their status or fetch configuration. Backup agents, antivirus, remote-management tools, time synchronisation and many business applications do it. That is why simple rules based on regular timing alone produce a lot of noise. What separates malware is context: a destination nobody else in the company uses, a recently registered domain or rented server, a device with no reason to run such software, a rhythm that started on a particular day, or traffic that does not fit the program the host is supposed to run. NetSenX judges beaconing against each host's own history and its destination, explains each alert, and lets you mark known software as a false positive, with the decision kept in the audit log.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/why-do-update-agents-look-like-beaconing

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is DNS tunnelling?](https://netsenx.com/en/faq/what-is-dns-tunnelling)
- [Can data be stolen through DNS without anyone noticing?](https://netsenx.com/en/faq/can-data-be-stolen-through-dns-without-anyone-noticing)
- [Can malware hide in DNS over HTTPS, and can we still see it?](https://netsenx.com/en/faq/can-malware-hide-in-dns-over-https)
- [What is low-and-slow data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-low-and-slow-data-exfiltration)
- [Why do simple bandwidth alarms miss data theft?](https://netsenx.com/en/faq/why-do-bandwidth-alarms-miss-data-theft)