• The more traditional approach catches and stores
all data for analysis at a later time (e.g., logging the
Internet usage of all users and only reviewing the
data after an alert).
• The second approach scans the data that pass through
the network and is selective about the data that are
captured (e.g., only logging blocked sites and specific
file formats from user activity).