Application Support To gather evidence from an unchanged application, the evidence start alerts are sent immediately after the Finished message, and the evidence end alerts are sent at the end of the session If willing to change an application, then alerts can be placed at “interesting” content |