Managing security incidents is essentially a problem of forensics. Peter Stephenson tests three broad groups of products that will enable organisations of all sizes to respond effectively to network attacks