Which type of data collection requires the largest amount of storage space?

Full packet capture (PCAP) is the process of recording all data packets (headers and payload) that pass through a specific network point. This method provides the most granular data for deep forensic analysis but, as a consequence, requires the largest amount of storage. In contrast, alert, transaction, and session data are all forms of metadata or summaries. They extract specific elements from the traffic, resulting in a significantly smaller data volume. For instance, session data like NetFlow only records conversation metadata (e.g., IPs, ports, byte counts), making it orders of magnitude smaller than a full capture of the same traffic.

A. alert data: Consists of small, event-driven notifications from security devices, representing the least amount of data collected.
B. transaction data: Captures application-layer request/response details, which is more voluminous than an alert but far less than a full packet stream.
C. session data: Contains metadata summaries of network flows (e.g., NetFlow), which is much more compact than capturing every packet's content.

1. Santos, O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 10, "Network Security Data," the section "Full Packet Captures" states, "Full packet capture generates a tremendous amount of data that is difficult to store and analyze." This is contrasted with other data types like NetFlow (session data) and IDS alerts, which are described as more manageable.

2. Sommer, R., & Paxson, V. (2010). Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. 2010 IEEE Symposium on Security and Privacy, 305-316. In Section II-A, "Data Sources," the paper notes that while full packet traces are the "richest possible source" for analysis, they come with "prohibitive storage and processing costs," distinguishing them from less voluminous sources like flow records. DOI: https://doi.org/10.1109/SP.2010.25

3. Cisco. (n.d.). Cisco Secure Network Analytics (Stealthwatch) Data Sheet. This official vendor documentation highlights the scalability of using NetFlow (session data) for enterprise-wide visibility. It implicitly contrasts this with the resource-intensive nature of full packet capture, which is not feasible for continuous, large-scale collection due to high storage requirements. The value proposition of Secure Network Analytics is built on the efficiency of session data over PCAP.