Exactly, this is how they do stuff like detecting data exfiltration (though that can also be done by traffic flow analysis also).