A method and apparatus for detecting suspicious activities surrounding the management of controlled substances in a medical facility is described herein, where the activities that may indicate the diversion of controlled drugs are flagged for further review. The activities are detected by invigilating application layer network packets, related to controlled substances, on the medical facility network, and processing these packets with a rules engine and machine learning generated rules to make a determination if the circumstances surrounding the packets indicate the diversion of controlled substances.