Network Forensics - Capturing an attack

Just read this a few moments ago, so only formulated some rough thoughts, and sharing to read what you think if you conduct network forensics.

The document confirms a Forensics capability to capture live attack events when predefined alarms are triggered.