1st make a Network Diagram: make sure it has at least two segments, preferably containing high-value assets. In each segment, we need the full path from asset to edge.

2nd Sensor Placement: Based on the diagram, identify where you would place your sensors and provide a rationale for your choices

Scope your NSM Infrastructure: Identify the resources you will need to store at least 30 days worth of logs using the metrics in the "Choosing an NSM platform" section in Chapter 2 (Collecting Network Traffic) of Bejtlich's, "The Practice of Network Security Monitoring" (PNSM).