Embodiments disclosed herein provide systems and methods for recording for analyzing traffic at an edge of a communication network. In a particular embodiment, a method provides processing a first portion of data packets directed into the communication network from outside of the communication network to determine whether a first sampling policy adequately assesses risk to the communication network. Upon determining that the first sampling policy does not adequately assess the risk to the communication network, the method provides adjusting the first sampling policy. The method further provides identifying a second portion of the data packets based on the first sampling policy. An amount of data packets included in the first portion of the data packets is larger than or equal to an amount of data packets included in the second portion of the data packets.