Detection & alerting · 7 min read

Tune lateral-movement detection for your network

Lateral-movement detection flags east-west traffic between hosts that don't normally talk. Here's how to reduce false positives without losing real signal.

What you'll need

  • NetFlow, IPFIX or sFlow already reporting from at least one router or switch
  • Admin role to edit detection rules
1

Let the baseline build

Lateral-movement detection compares current east-west flows against a learned baseline of which hosts normally talk to each other. Give it at least seven days of traffic before tuning, so the baseline reflects a real week, not a partial one.

2

Exclude known-noisy pairs

Backup jobs, vulnerability scanners and configuration-management tools legitimately talk to many hosts at once. Add them to the allowlist under Detections > Lateral movement > Exclusions rather than raising the global sensitivity.

3

Adjust sensitivity by segment

A flat, DMZ-facing segment should stay strict; a segment with legitimate broad east-west chatter (like a Kubernetes cluster) can run at a lower sensitivity without hiding a real attacker moving between segments.