NPM — Network Performance Monitoring
Concept
Network Performance Monitoring (NPM) measures how well the network and the applications running over it are performing. Where NDR asks "is this traffic malicious?", NPM asks "is this traffic healthy?"
NPM helps answer questions such as:
- Is a slow application caused by the network, the server, or the application?
- Which links or services are congested?
- When did a performance problem start, and which users were affected?
Passive monitoring
NPM in SentriaOne xSIEM analyzes traffic passively — it observes a copy of real traffic received through packet mirroring rather than generating test traffic. This shows the performance that real users and systems actually experience, without adding load to the network.
Common performance indicators
The indicators below are commonly used in network performance monitoring.
| Indicator | Meaning |
|---|---|
| Latency | Time taken for data to travel between two systems |
| Response time | Time taken for a server or application to respond to a request |
| Throughput | Amount of data transferred over a period of time |
| Retransmissions | Packets that had to be sent again, often a sign of loss or congestion |
| Errors | Failed connections or application error responses |
NPM in SentriaOne xSIEM
| Capability | Description |
|---|---|
| Passive, real-time deep protocol analysis | Traffic is analyzed in detail as it happens, without active probing |
| Application and network performance visibility | Performance can be viewed for both the network and applications |
Why NPM belongs in a security platform
Performance and security data describe the same network. Combining them helps both teams:
- A sudden change in traffic volume or behaviour can be an operational problem or a security incident — having both views helps tell them apart.
- Security investigations benefit from knowing which services and communication paths are normal.
- IT operations teams gain visibility from the same data already collected for security, supporting the IT operations outcome of the platform.
For a step-by-step example, see How to troubleshoot slow connections.