The detection of malicious activity can occur at many places within an enterprise. One area that is a natural extension of perimeter based approaches is that of internal network monitoring. This talk will discuss work done to better detect malicious activity on an enterprise by monitoring internal network traffic. The state of the art will be discussed, as well as the limitations inherent in this monitoring approach. Promising results will be discussed as well as methods that were not as effective.