Drew Bradshaw, Technical Solutions Architect at Cisco, explains how to configure 'Data Hoarding' alarms to investigate a host within a network that has downloaded an unusual amount of data from one or more servers to help detect insider and advanced threats.