Tracking the bad guys

From Wiki

Security starts with finding bad people. But once you know where they are, how do you watch and document their actions so you can understand the damage they've done, stop it from happening again, and hopefully document it to bring them to justice?

[edit] Experts:

Mark Bagley, Senior Product Manager at Splunk