
Collect at edges

best for security-related activities
netflow is input-based
reduce quantity of data (don't enable in transit)

