I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Conte

I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Content included. Content is where the bad things go, of course, and a lot of the features that come out of full packet data are the ability to do things like auto-detonation of executable files for malware detection. Extremely content-based detection heuristics.