1st make a Network Diagram: make sure it has at least two segments, preferably containing high-value assets. In each segment, we need the full path from asset to edge.

2nd Sensor Placement: Based on the diagram, identify where you would place your sensors and provide a rationale for your choices

Scope your NSM Infrastructure: Identify the resources you will need to store at least 30 days worth of logs using the metrics in the "Choosing an NSM platform" section in Chapter 2 (Collecting Network Traffic) of Bejtlich's, "The Practice of Network Security Monitoring" (PNSM).

Use this as resource if needed: https://someplace-else.neocities.org/books/The%20Practice%20of%20Network%20Security%20Monitoring.pdf