Shunting traffic by changing a router or switch, putting up fake systems for bait, and other methods are all examples of such behavior. Both network sniffer and host-based forensic information were made available for this article. In the Kurosawa film Rashomon, we see many points of view of the same crime. While some data was corroborated, it is only after collecting all perspectives from the different witnesses that the truth is ascertained. Our traversal from the host to network levels has hopefully demonstrated that only with the marriage of the two can a complete picture of the past truly be constructed.
Network monitoring sees verbs or actions, hosts see consequences.
Of course, most people are only prepared for an accident or incident after they've been burnt at least once. This isn't possible on an unprepared network that forgets data as soon as it has passed. In all cases, you should attempt to save as much data as you can for as long as you are able. It's easier to save the raw network data than host-level information because the latter is almost inevitably processed in some fashion before storage.