Network Monitor HTTP Requests
I have a question about how Network Monitor works with HTTP.
I know that it works great and creates incidents when a message goes from a client on the local network to a server on an outside network. So basically, when a client does a POST to an outside server.
What about scenarios where an outside user requests data from one of our webservers and we respond back with some sensitive data that matches a DLP rule(in the clear, non-https)? Would that get captured by the network monitor?
Thanks for the help, I really hope this made sense.