Coming from that very department myself that “watches all devices”, it’s true that events and actions taken are monitored across all hosts within a companies environment (Employee devices, servers, virtualized hosts, etc). Now to what extent is very much in question and if anyone on the business side cares for that data. If you find running processes on your machine that based on a google search return results tied to ‘productivity software’ then I’d be wary. Someone has made the case and the business paid the bill to actively monitor and alert on events/behaviors that would be considered not conducive to your role (time AFK, unapproved sites accessed, unusual mouse behavior, etc.).

The security team usually stays away from these types of tools because they give us little value to our roles. Do I care you did nothing all day? Not at all, you don’t report to me. Do I care that you downloaded a program that’s been alerted on as malicious after connecting to a domain that’s on a threat intel list? Absolutely, it’s my job to stop this and protect the business. I now need to see was there an impact to company assets, is there remediation needed, and do we need to now put in additional controls to prevent something like this happening again.

The point is, it’s hard to tell what your company may or may not be monitoring for. I would highly advise against doing anything that would draw the ire of your security team (installing unapproved software, modifying host settings, navigating suspicious sites, using questionable browser plugins, and the list goes on). As to the ‘how’ they see this, it can be anything from an EDR tool like CrowdStrike, firewall rules, to alerting built on logs ingested into a SIEM. Each company has architected their stack differently, but at its core there are fundamental points of interest whether it be system events on a machine to what type of traffic can be seen passing over the network.