How Do I Monitor Your Network for Intrusion?
Key takeaways
- Signature-based detection finds known attacks and misses new ones, which is why behavioural rules matter more in most intrusions.
- Outbound connections from a server to an unknown external address are a stronger intrusion signal than most inbound ones.
- DNS logs are the cheapest high-value monitoring in a small office, because a command server needs a domain name to be reached.
- A baseline of normal traffic is a prerequisite for anomaly detection, and no commercial product can invent one for you.
- Detection without a defined response does nothing, so every alert needs a named owner and a written first action.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should I look for in my network traffic?
Four patterns, in rough order of how often they turn out to be real. An internal host communicating with an external address on a port that serves nothing legitimate, especially outbound traffic on ports 443 and 8080 to a brand new domain. A sudden change in volume, such as a laptop that normally sends nothing sending gigabytes overnight. Flat or unusual internal traffic, where one workstation is systematically talking to many others, which suggests a worm or a scanning tool. And asymmetric access, where a device is reachable from a segment it should never reach. Because encrypted traffic hides the payload, most of these signals come from metadata: who, when, how much, and to which destination.
Do I need a full network detection and response tool?
For a business with a handful of servers and a managed internet connection, not immediately. The order that works is: turn on the logging your firewall, router and DNS server already support, forward it to a central store, and learn to read it. Add a network detection and response product or a managed monitoring service when you have the volume of alerts to justify it, usually after a first incident or when a compliance requirement asks for continuous monitoring. Buying the tool first usually produces a dashboard nobody reads, and an unwatched dashboard is not a control, it is a decoration.
How do I avoid drowning in false positives?
You tune with a baseline, and you start with a very short rule list. Watch one real working week before writing any rule, so you know what normal looks like for your own network, and write that down. Then pick the three to five conditions that genuinely matter to you: a new external destination, a new admin account, a disabled endpoint agent, a spike in denied inbound connections, and a change to a firewall rule. Give each a threshold that fits your traffic rather than a generic default. Assign an owner and a first action to each alert, and review which alerts fired in the previous month and retire the ones that never mean anything in your environment.
| Signal | Source | Usual meaning |
|---|---|---|
| New external destination | Flow or DNS logs | Command server or unapproved cloud service |
| Outbound spike on a server | Firewall session logs | Data staging or exfiltration |
| Intermittent beaconing | Flow or DNS logs | C2 heartbeat from an infected host |
| New local administrator | Domain controller audit log | Account takeover or insider addition |
| Firewall rule change | Firewall config log | Unauthorised opening of a path |
| Endpoint agent silent | Endpoint management | Tampering or a blind spot |
| Denied inbound spike | Firewall logs | Scanning or brute-force attempt |
What are the frequently asked questions?
Get a straight answer on this
Share your current firewall and DNS setup with us, and we will run a baseline monitoring review and return the five alerts worth building first.
Send us the details See pricing