My company utlizes Corvill appliances and network taps on the switches to monitor activity. We mostly use it for metrics, but no reason it couldn't monitor exfil. Onky problem is it only has enough storage for about 3-4 days of network traffic.