Summary
Incident response requires visibility into networks, systems, services, and applications. Gathering and centralizing information from each component of your organization’s infrastructure and systems can allow you to more easily detect, respond to, or even prevent incidents.
Network monitoring is often done via router-based monitoring, which relies on network flows, SNMP, and RMON, all common means of gathering information. Flows provide summary data about traffic, protocols, and endpoints; SNMP is used to gather device information; and RMON uses probes to gather statistical, historical, and event-based data. In addition, organizations employ active monitoring using ping and performance monitoring tools like iPerf to gather data by sending traffic. Passive monitoring relies on capturing information about the network and its performance as traffic travels through network devices. Passive monitoring doesn’t add traffic to the network and acts after the fact, rather...