Comment by unethical_ban
16 hours ago
There are companies that mirror their traffic to storage for a few days to be able to look back and troubleshoot issues. ALL their traffic, proactively.
16 hours ago
There are companies that mirror their traffic to storage for a few days to be able to look back and troubleshoot issues. ALL their traffic, proactively.
For US federal government, "Office of Management and Budget" says to store 72 hours of packet capture, since 2021 (partially in response to SolarWinds attack). (M-21-31)
https://www.cisa.gov/sites/default/files/2023-02/TLP%20CLEAR...
I do that with very, very low traffic industrial automation systems.