Keeping a network safe requires a broad array of tools. Detection of anomalies plays the important role of spotting trouble early. Anomalies can happen in incoming, internal, and outgoing traffic. On the incoming side, recognition of attacks in progress provides an early warning. Within the network, malware that has successfully invaded one machine may launch attacks on others. Outgoing traffic could include attempts to contact command-and-control servers. When monitoring detects these events, security software or administrators can take action to stop the threat quickly.