For protective monitoring to be effective the raw events recorded on all the in scope hosts and services need to be gathered together. Once gathered the information is normalised, aggregated and enriched. This enriched data is then suitable to begin the next phase - The analysis.