As head of network security for a company you receive reports from the network administrator of excessive traffic on the network which is starting to impact the users ability to access key applications both on network and in the cloud. The network administrator is unable to determine the source of the issue but suspects a cyber attack.

As head of network security what tools and methods would you use to investigate the excessive traffic and determine its source and potential mitigations or remediations for the issue?

Hint - the excessive traffic was first detected at the core router on the network where the internet service is connected. Optionally you may attach a diagram to support your answer.