I want to be able to track bytes that are sent and returned. Does one need "flows" turned on in order to do this? If so. how does one turn on "flows". I don't believe we are capturing these in our current SEIM environment.
Not necessarily, but you do need something reporting byte counts. Many firewalls will provide it. Flows would be my last resort. Thanks.