To store large amounts of forensic data on the host where Console runs to enable a more rapid and effective response to incidents

To sort through large amounts of audit data manually in order to identify developing attacks

To identify and suppress all audit events generated by the defender

To correlate individual events to identify potential attacks and provide a sequence of process, file system, and network events for a comprehensive view of an incident