Question

What is the least important information when you analyze a public ip address in a security alert?

Answer 1

The lack of specific details regarding the content of a specific field of traffic makes the connection of network flow highly concise. Network flow enables analysts to record the presence of communication in a very small footprint, which means the data can be collected economically across a large network and stored for months to years

Network flow contain sufficient indicative information to allow network defenders to perform a variety of analyses to search for threats or convert information that can help defender understand what is going on.