Network Monitoring

Overview

Network monitoring is the ongoing collection and analysis of network activity to understand normal behavior, spot performance problems, and detect possible security threats.

Key concepts

Ingress/egress, east-west/north-south traffic
Firewall, DNS, and proxy logs
IDS/IPS, baselines, anomalies, beaconing

How it works

Network monitoring is the ongoing collection and analysis of network activity to understand normal behavior, identify performance problems, and detect possible security threats. Tools are used to monitor network flow, and a variety of methods can be applied depending on what you're watching for.

Traffic direction concepts

Term	Meaning
Ingress traffic	Traffic entering an organization's network — often checked for malicious content.
Egress traffic	Traffic leaving an organization's network — often checked for data exfiltration.
East-west traffic	Traffic moving between systems inside the same internal network — where lateral movement typically happens.
North-south traffic	Traffic moving between internal systems and external networks (includes ingress and egress).

Logs & systems used to monitor

Term	Meaning
Firewall log	Records of connections allowed, blocked, or inspected by a firewall — lets SOC teams monitor what sites are being used and catch malicious activity.
DNS log	A record of domain-name lookups made by devices or users.
Proxy log	A record of web requests passing through a proxy server or secure web gateway.
IDS	Monitors activity and generates alerts for suspicious behavior or known attack patterns.
IPS	Detects and automatically blocks or prevents certain malicious network activity.

Anomaly & threat concepts

Term	Meaning
Baseline	A record of normal activity, used to spot behavior that differs from expected patterns.
Anomaly	Activity unusual compared to a system's normal behavior.
Beaconing	Repeated, patterned communication between a compromised device and an external system — may indicate C2 activity.
Command-and-control traffic	Communications an attacker uses to control a compromised device or receive data from it. Catching it early reveals what the attacker is trying to do.

What blue teams actually watch for

Failed and successful logins — especially unusual admin, service-account, VPN, or cloud-account activity.
Unexpected remote-access connections or logins from unfamiliar locations.
Large outbound data transfers, especially to unfamiliar cloud storage or external IPs.
Unusual DNS queries — suspicious domains, unexpected subdomains, repeated failed lookups.
Newly opened ports, unexpected services, or devices talking to unknown destinations.
Firewall/router/switch configuration changes and newly created admin accounts.
Traffic between network segments that normally don't communicate.
Repeated outbound connections at regular intervals (possible beaconing).
Attempts to access sensitive systems, file shares, backups, identity infrastructure, or domain controllers.