
Use information collected from a variety of computer network defense resources (including intrusion detection system alerts, firewall and network traffic logs, and host system logs) to identify, analyze, and report events that occur or might occur within their environment







