Making an investigation in email server like the exchange, postfix etc., causes
a. serious performance consumption,
b. finding a needle in a haystack with a single source,
c. the need for the coordination of different teams which delays to detect the incident and response it. With the survey we conducted, we observed that the average period of making an investigation in the enterprise sector was one day.