Most security tooling looks inward: what is installed, what is vulnerable, who logged in. Far less of it answers a simpler question: what is each device sending out to the internet, and should it be? That is where data leaving the business, software nobody approved and devices that have been compromised tend to show themselves first.
15 minutes
per collection window
7 reports
24 hours, 7, 30 or 90 days
Metadata only
no content, no URLs, no user names
Off by default
switched on per client
How the data is collected
Network Egress uses the network trace that is built into Windows, so there is no driver to install and no extra monitoring product. On each managed device the agent groups outbound traffic into 15-minute windows by process, destination, port and protocol, and sends only that summary.
- Metadata only. No content, no URLs and no user names are recorded.
- Private traffic dropped on the device. Connections inside your own network never leave the machine.
- Off by default. Collection is switched on per client, alongside a staff privacy notice agreed by the client's data protection officer.
- Advisory. It shows and records. It does not block anything.
The seven reports
Each report runs for the last 24 hours, 7, 30 or 90 days. You can view it in the console, download it as CSV, or print it and save it as a PDF.
- Data leaving the network. Destinations and devices ranked by data sent, to spot large uploads or exfiltration.
- New destinations. Destinations seen for the first time on your estate in the period, with the device and application that first reached them.
- Flagged countries. Traffic by country with the countries you have flagged first, how much leaves the UK, and every connection to a flagged country.
- Applications talking out. Which programs make outbound connections, how many destinations and countries each reaches, and how much they send.
- Unusual ports. Outbound traffic on ports other than the common web, DNS, time and mail ones, where remote access and file transfer tools tend to appear.
- Cloud and SaaS services. Online services in use, by the network that owns the destination, to find services nobody signed up to on purpose.
- Device summary. One row per device: destinations, countries, applications, data sent and received, and flagged country traffic.
Reading country data. Countries come from IP geolocation. Large content delivery networks can make a destination appear to be in one country when the service you use is somewhere else, so treat a flagged country as a prompt to look, not as a verdict.
Turning a report into an action
- A device in the data leaving report sending far more than its peers is worth a conversation before it is worth a ticket.
- An application in applications talking out that is not in your approved list is a candidate for AppBlocker.
- A new destination reached by a single device, from a process you do not recognise, is the early signal most incident timelines wish they had.
Frequently asked questions
Does Network Egress read the content of traffic?
No. It records metadata only: which process talked to which destination, on which port, how much and when. No content, no URLs and no user names.
Do we need to install a driver or a network appliance?
No. It uses the network trace built into Windows, collected by the Assure agent that is already on the device.
Can it block traffic?
No. It is advisory. Use AppBlocker to stop an application running, or your firewall to block a destination.
How far back can the reports go?
Each report can cover the last 24 hours, 7, 30 or 90 days, subject to the retention set for the client.
See what leaves, and where it goes
Network Egress shows every device's outbound traffic by process, destination and country, with seven standard reports ready to view, export or print.
Book a demo
