## Module 29 Review
NTA gives you the ground truth.
*   **Wireshark** for deep inspection of a single stream.
*   **Zeek** for high-level logging of all traffic.
*   **HTTPS** hides content, but metadata (JA3, certificates, size) still reveals a lot.

Next: Proactive defense with Threat Hunting.