Section: Security Policies and Procedures

The event described falls under the 'action on objectives' category of the Cyber Kill Chain. This stage occurs after the attacker has established a foothold within the network and begins to execute their intended actions, such as data exfiltration. Reference:: The Cyber Kill Chain framework outlines the stages of a cyberattack, with 'action on objectives' being the final step where attackers achieve their primary goal, such as data theft

Deep packet inspection is a form of packet filtering usually carried out as a function of your firewall. It is applied at the Open Systems Interconnection's application layer. Deep packet inspection evaluates the contents of a packet that is going through a checkpoint.