At ShmooCon talk I provided a series of case studies showing the importance of Network Security Monitoring data. Alert management is not security investigation, and unfortunately most products and processes implement the former while the latter is truly needed. Almost everyone who argues against these methods is not directly responsible for the technical aspects of detecting and responding to intrusions. I am glad to see these sorts of stories because they show how people in the trenches do their jobs. I have yet to meet an analyst who rejects my methods or the need for collecting NSM data.”]
Source: https://taosecurity.blogspot.com/2007/03/ayoi-on-importance-of-nsm-data.html