LuxHawk.lu (+352) 27 52 67 45

← Back to knowledge

Cybersecurity sensor: definition, purpose and limits

Technical and IT 7 min Author : Arnaud Colin Updated : 06/10/2026

Summary

A cybersecurity probe observes a defined part of an information system’s communications or events to identify signs of abnormal or malicious activity. Its effectiveness depends on its position, the data available to it, its detection rules and the human handling of alerts. It does not necessarily block an attack and does not replace patching, endpoint protection or an incident-response procedure.

What does “probe” mean?

The term covers several types of sensors. A network probe analyses traffic or communication metadata. A sensor installed on an endpoint observes local events instead. Other systems collect logs sent by servers, applications or security equipment. ANSSI describes logging as a source that supports both detection and post-incident analysis.

A probe is therefore defined not only by its appliance or software, but by its observation point, the data collected and the purpose for which they are used.

What can it detect?

Depending on its configuration, a probe may highlight communication with a destination known to be malicious, an unusual sequence of connections, abnormal volume, attempted movement between systems or behaviour that departs from an established baseline. Indicators of compromise shared by organisations such as CIRCL through MISP can feed some detection rules.

An alert is nevertheless a signal that must be assessed. It may reflect an attack, unusual legitimate activity or an unsuitable rule. The probe provides evidence for an investigation; it cannot determine the reality or severity of an incident on its own.

What are its limits?

A probe sees only the traffic or events made available to it. Encryption can restrict visible content, poorly documented architecture can leave blind spots, and an attacker may use a technique not covered by the rules. The probe does not patch vulnerable software, restore a backup or automatically assign a decision to the appropriate person.

Before deployment, define the scope, collection points, retention period, alert recipients and response procedure. Logs must themselves be protected against unauthorised access and alteration, as recommended by ANSSI.

Can network monitoring involve people?

Yes. An IP address, account identifier or connection history may be personal data when it directly or indirectly identifies a person. The purpose limitation, data minimisation, storage limitation, security and information principles in the GDPR, notably Articles 5, 13, 25 and 32, must then be considered. The regulation is cited in its official version published in the Official Journal of the European Union, with corrigenda available through EUR-Lex.

A case: when the monitoring system itself is compromised

On 15 February 2021, France’s ANSSI published report CERTFR-2021-CTI-005. It describes a campaign against internet-facing Centreon servers — a monitoring product. The campaign ran from late 2017 to 2020. The affected entities are mainly French IT service providers, hosting companies in particular.

On the compromised servers, ANSSI found two backdoors: a webshell named P.A.S., version 3.1.4, and an Exaramel backdoor. The report states one point worth reading to the end: the initial compromise path is not known.

Two things follow, and they bear directly on an SME considering a probe or a monitoring tool:

  • A tool that watches everything is a tool that reaches everything. A probe, a monitoring console, a backup agent or a remote-control tool are installed everywhere and hold high privileges. They protect; they also widen what an attacker gains if they reach them.
  • Three years is the duration, not the sophistication. What let the campaign last is not the finesse of the tooling. It is that nobody was watching what those servers did. A probe that collects without being read is not detection: it is an archive.

The article What is a security vulnerability? shows the opposite case: a known flaw, patched too late. Here the entry flaw remains unknown, and it is the watching that was missing.

What an SME has to decide

None of these decisions is technical. They are taken before buying a tool, not after.

  • Who reads the alerts, and when? This question decides everything else. A probe without a reader detects nothing. If nobody is there in the evening or at the weekend, write it down and plan around it.
  • How long are logs kept? An intrusion is often discovered weeks after it began. Seven days of logs will not reconstruct what happened last month.
  • Who has access to the monitoring tool, and from where? It is the most interesting account on the estate. It deserves two-factor authentication and restricted access, just like the accounting system.
  • What happens to an alert? Who opens it, who decides it is real, who may isolate a machine. Without those three answers, an alert becomes an attachment people forward.
  • Have staff been informed? Monitoring a corporate network touches employee data. Informing people, and consulting the staff delegation where one exists, are not formalities: they condition the lawfulness of the arrangement.

Sources

Links checked on 28 September 2026.

A probe is most useful when its alerts reach a function responsible for reviewing them. That organisation is explained in What is a SOC?. The technical weaknesses it may help identify are introduced in What is a cybersecurity vulnerability?.