• Provide deep visibility of all system and user activity
• Create a secure, forensic audit trail of all activity
• Automate as far as possible the analysis of activity to identify threats, undesirable activity, bad practice
• Deliver activity reports, alarms and alerts
• Provide raw data and enhanced data to support studies, investigations, improved security practices
• Provide forensic evidence of guilt (or innocence)!
• Provide proof of security good practice (compliance)
• Improve the behaviour of internal staff (like CCTV)