What other data is collected?

We collect data about the traffic, not what’s in the traffic, in addition to alert data about the signatures firing. This data is called NetFlow. NetFlow is only collected for on-premises sensors and not available for Cloud.

Source IP
Destination IP
Source port
Destination port
TCP flags
Number of bytes of traffic sent and received
Timestamp information (start, end, and duration of connection)