I have made a question about network forensic solution on enterprise network adt the moderator avid closed my question because it's think it's the same of another question.
The question is not the same and I want explain to him why he need to reopen it.
The two question is different because my question ask for:
- enterprise solution to store network data from 1 day to 1 year, associate network storage is needed and a way to manage Terabyte of data - engine to see network traffic from layer 4 to layer 7, not only packet but also layer 7 traffic to see what the specif user do and for example analyze more session of the user in the past 3 month .
- my solution is for monitory all the aspect of the network and not only for monitoring incidents on a network
- i cant use wireshark to sniff and analyze 10Gb of bandwidth, i need a GUI to restrict the traffic, search for conversation and make automatic alert on data without a manual human analysis
- my question is more related to lawful interception and not on incident response analysis after a simple break in .
anyone can explain me how i can contact the moderator Avid to reopen my question ?