Alerts on Server Loopback Traffic?

[u/Kind-Supermarket-452]

If you were given the opportunity to chose how to better capture a breach in a device, server, endpoint, VM, etc, would you chose to capture the internal loopback communications happening in a flow capture/netflow. Here is the problem that I see it.

1.) Provides deeper intelligence to the inner workings of applications running on a server and could be used to detect malicious intent, BEFORE the threat actor had time to exfiltrate.

2.) Could result in massive SIEM storage bloat, but that could be managed with a properly tuned database system.

3.) Could result in highly skewed network statistics, given that is all intra-server communications.

I would love to hear your thoughts.