Abstract: A threat detection network, an endpoint of a threat detection network, a server of a threat detection network and a method for protecting sensitive data in a threat detection network, which threat detection network includes at least one end point, at least one server and an encryption key storage, such as a key server. In the method the endpoint generates a data encryption key to be used for encrypting sensitive data and the endpoint sends the encryption key to the encryption key storage. When the endpoint records an event, it checks the event related information for identifying sensitive data. The endpoint uses the encryption key to encrypt the event related information identified as sensitive data. The endpoint sends at least part of the event related information with encrypted sensitive data to the at least one server.