EXECUTIVE SUMMARY
Recent years have taught us that no one is immune to security breaches.
Organizations from all sectors are under constant pressure to identify successful attacks and respond quickly in order to minimize damage and losses.
Unfortunately the investigation tools that are currently available have failed to meet enterprise business needs. Log-based solutions are inherently incomplete as they are missing the actual data, and packet-based forensics tools are too difficult to use and cannot scale in bandwidth and requisite storage capacity. Even wellfunded security teams find it hard to handle the constant alerts triggered by their own security measures.
To overcome today’s forensics challenges, security teams must arm themselves with better tools to get access to the detailed information they need, but also save effort and time in the process. To help you find the right solution for your organization, the following set of requirements provides key guidelines for performing successful security investigations.
