STORE PACKETS LONGER, FIND THEM FASTER
Smart PCAP is a highly efficient approach to packet capture that links Zeek® logs, extracted files, and detections with just the packets you need for investigation.
Corelight's Smart PCAP gives security teams complete control over packet capture. Compared to full PCAP, it extends investigation lookback windows from days to weeks or months by capturing only the packets needed. Accelerate investigations by pivoting quickly from Corelight alerts to PCAP files with one-click packet retrieval right from your SIEM.
- Up to 10x longer lookback windows vs. full PCAP
- Set precise, powerful rules to capture only useful packets
- Flexible storage options via Corelight, BYO hardware, or the cloud (S3)
- Pivot quickly from alert to PCAP files with one-click retrieval via SIEM or Investigator
Have questions?
Talk with one of our experts today.
