Flow Directionality Support : Part 1

When the security team identifies a suspicious activity, they often turn to NetFlow or IPFIX first to gain insight into how the bad actor gained access to the internal network. Should a network incident response system used for tracking down malicious communication activities place emphasis on flow directionality?