Security requires visibility into mirrored packet content for an investigation, rather than only aggregated flow metadata. Which approach best fits?

1. Use a supported Packet Mirroring configuration and a controlled collector.
2. Rely on connection tracking for permitted return traffic, subject to supported firewall behavior.
3. Use supported service-account targeting in firewall rules.
4. Enable and inspect Firewall Rules Logging for the relevant rule.