I. Examine the reasons why log data should be compiled for analysis over time. This helps to examine what happened when an intrusion occurred and the motive (or reason why) as well as who may also be exposed.
II. Recall that even though an IDPS may fail at an intrusion, the data and information collected can aid in an investigation and provide forensic evidence that could help catch the perpetrator. Additionally, this can also determine how frequently intrusions occur.