Protective monitoring involves the collection of live activity data on networks and endpoints to watch over the behavior of users. The purpose of this process is to protect resources, with particular attention paid to activities related to data. Protective monitoring has become increasingly important as data breaches have increased and hackers have created increasingly sophisticated techniques, such as advanced persistent threats (APT).