Smart PCAP
Rule-based selective packet capture
Corelight Smart PCAP records packets by rule instead of storing every byte that crosses the wire. You decide what goes to disk: IP addresses, ports, protocols or events raised by Zeek and Suricata. ICWT sets the capture rules and the retention policy together with your team. Each Zeek connection log gains an spcap.url field, so an analyst pulls the exact packets from the SIEM or from the Investigator console with one click. According to Corelight, this extends retention from days to weeks or months while lowering storage costs. Packets can live on local disk, an iSCSI array, AWS S3, Azure Blob or Google Cloud Storage. Downloads sit behind authentication and allow or deny lists, so sensitive traffic stays with authorized staff.
Why Corelight?
Corelight is an Open NDR platform that turns network traffic into evidence your SOC can act on: Zeek logs, Suricata alerts, YARA file analysis and selective packet capture with Smart PCAP. Appliance, virtual, software and cloud sensors feed that evidence into Corelight Investigator or your own SIEM, where AI/ML detections and Agentic Triage shorten investigations.
Need Smart PCAP in your organization?
As a certified Corelight partner, we'll help you deploy and configure the solution.