What is network security monitoring (NSM)? Definition & tools

Network security monitoring assumes that prevention eventually fails, so defenders watch the network itself for evidence of compromise. Rather than trusting only firewalls and antivirus, NSM looks at what is actually flowing across the wire to catch attackers in the act.

How does network security monitoring work?

NSM relies on three kinds of data:

• Full packet capture records raw traffic for deep inspection.
• Session and flow data summarize who talked to whom, when, and how much.
• Network metadata and alerts describe protocols, certificates, and signature hits.

Analysts then correlate these sources to spot beaconing command-and-control, data exfiltration, lateral movement, or scanning.

Common NSM tools

• Zeek turns raw traffic into rich, structured logs and metadata.
• Suricata and Snort provide signature and protocol based intrusion detection.
• Arkime and Wireshark support full packet capture and analysis.
• A SIEM such as the Elastic Stack centralizes and searches the resulting data.

NSM pairs naturally with blue teaming and DFIR, and detections are often described using the MITRE ATT&CK framework.

How to practice network security monitoring hands-on

On Purple Edge the network-security-monitoring learning hub gives you live environments where traffic is generated and you analyze it with tools such as Zeek, hunting for malicious behavior in real network metadata rather than static screenshots.