Network activity is the observable exchange of data over a network, including connections, packets, flows, and protocol requests. Security teams inspect it to identify normal communication, detect anomalies, trace command-and-control traffic, and monitor access to hosts, services, and cloud endpoints.
What Network Activity Reveals
Network activity is more than simple packet movement. It exposes who is talking to whom, which protocols are in use, how often connections occur, and whether a host is behaving normally or deviating from expected patterns. That makes it a foundational observability signal for both operations and security investigations.
How Security Teams Use Network Activity
Analysts use network activity to establish baselines, spot unusual destinations, and correlate traffic with user, host, and application context. It can show repeated beaconing, sudden spikes in outbound connections, suspicious east-west movement, or protocol misuse that other telemetry may miss.
Because it captures communications rather than intent, network activity is most useful when combined with logs, endpoint telemetry, and asset context. A single connection may be benign, but a pattern of connections, timing, and destination diversity often reveals the real story.
Common Signals and Traffic Patterns
Useful signals include DNS lookups, TLS handshakes, HTTP requests, SMB sessions, remote administration traffic, and flows to cloud services or internet-facing hosts. Security teams also look for long-lived sessions, rare ports, failed connection attempts, and traffic that does not fit the expected role of the source system.
In mature environments, these patterns help distinguish routine application chatter from activity that suggests discovery, tunnelling, command-and-control, or data movement. The value comes from context: normal for one workload may be highly suspicious for another.
Why Network Activity Matters for Detection and Investigation
Network activity is often the earliest visible clue that something is wrong, especially when an attacker is using living-off-the-land techniques or operating through legitimate tools. It also helps investigators reconstruct timelines by showing initial access, follow-on communication, lateral movement, and exfiltration paths.
For cloud and hybrid environments, it is equally important because many business services now communicate over public endpoints, load balancers, APIs, and managed control planes. That makes visibility into egress, service-to-service traffic, and unusual destination changes a critical part of threat detection.
For deeper context on how cloud telemetry can be used to interpret network activity, see AWS CloudTrail Guide, which covers network activity events, trail integrity, and related audit signals.
Risk and Threat Considerations
Network activity becomes risky when organisations treat it as generic traffic instead of a security signal. Attackers can hide in ordinary-looking flows, abuse trusted cloud services, or blend malicious requests into business traffic, which makes weak visibility a detection gap rather than a logging issue.
Failure mechanism: If baselines are incomplete or monitoring is too coarse, malicious communication can appear normal, allowing command-and-control, lateral movement, or data exfiltration to continue undetected.
Impact: The result can be delayed containment, broader compromise, loss of sensitive data, and reduced confidence in incident reconstruction because key communication paths were never observed or were observed too late.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Network and Environmental Monitoring | Network activity is the core subject of continuous monitoring and anomaly detection. |
| DE.CM-09 — Monitoring for Malicious Code | Suspicious network activity often reveals malware beaconing or command-and-control behavior. | |
| Recommendation — Monitor network communications continuously to detect anomalies, suspicious destinations, and unexpected protocol use. Correlate network telemetry with malware indicators to identify beaconing and other malicious communications. | ||
| MITRE ATT&CK | T1071 — Application Layer Protocol | Network activity frequently exposes adversary use of common application protocols for command and control. |
| T1021 — Remote Services | Network activity reveals remote service use during lateral movement and administrative abuse. | |
| Recommendation — Map suspicious protocol traffic to T1071 and hunt for command-and-control over web, DNS, or other app-layer protocols. Trace remote service connections to identify lateral movement and unauthorized remote administration. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Network activity analysis depends on generating records that capture communications and flows. |
| SI-4 — System Monitoring | Network activity is a primary input to system monitoring and threat detection. | |
| SC-7 — Boundary Protection | Boundary controls govern what network activity should be allowed or denied across trust zones. | |
| Recommendation — Generate the network and service audit records needed to reconstruct communication paths. Use system monitoring to detect unusual connections, traffic patterns, and destination changes. Apply boundary protections to restrict unexpected inbound and outbound network paths. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | This control family directly addresses monitoring network traffic for malicious activity and misuse. |
| Recommendation — Inspect network traffic for anomalies, unauthorized channels, and signs of attacker activity. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Network activity is interpreted in a never-trust, verify-every-connection model. |
| Recommendation — Treat each network request as untrusted and verify access based on context and policy. | ||
Practitioner Guidance
What to watch for: Focus on traffic that is rare for the host, inconsistent with its role, or unexpected for the protocol and destination. Repeated beacons, unusual DNS behaviour, new external endpoints, and unexplained east-west movement are often more valuable than raw volume alone.
Practitioner note: Network activity is most actionable when tied to asset inventory and identity of the communicating workload, service, or user. Without that context, even good telemetry can produce noisy conclusions instead of defensible detections.
Related resources from NHI Mgmt Group
- Who is accountable when AI or contractor activity bypasses network-level controls?
- How should cryptocurrency exchanges implement proactive investigations to detect illicit network activity before it spreads?
- What breaks when security teams investigate network activity without business context?
- What is the difference between securing the network path and detecting suspicious directory activity?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org