Network forensics is being rearchitected for AI-scale environments. This piece lays out a vendor-diverse, federated data fabric: Gigamon for visibility, ExtraHop for forensics, Forescout for enforcement and Splunk for operations. This solution maps to the Infrastructure Security domain of WWT's ARMOR framework and previews where AMI metadata and the DPU substrate are taking the stack next.