I had this thought the other day and I'm curious to see what other people would think.
Most of us have probably had NetWitness in for a number of years now.
It got me thinking, if you had to implement NetWitness again, what would you do differently. Would you change your infrastructure drastically, would you remove/add things to monitor that you do/do not right now. etc.
