NSM

NSM is the practice of collecting and analyzing network data, including flows, sessions, and full packets, to detect and investigate intrusions. Unlike simple alerting, NSM emphasizes keeping rich network evidence so analysts can reconstruct attacker activity after the fact. It matters because detection will never be perfect, and NSM ensures you have the data to investigate what your alerts missed.