Connection insights
The flows that deserve attention.
Traffic relationships, protocol state, and priority signals stay connected to the packets that produced them.
- 01Priority conversations
- 02Protocol state
- 03Exact frame pivots
PacketSafari Triage
Find hidden evidence across the capture.
Small capture or enormous one, Triage uses expert-curated investigation patterns, protocol playbooks, rules, and correlation to identify important connections, anomalies, and security findings—then guides Agent to exact packet evidence it may not retrieve from a bounded fast start.
- Small to very large PCAPs
- Known cases guide the search
- Exact evidence for Agent
Evidence mapChoose what you need to investigate.
Evidence view
Packet proof stays attached. Findings remain inspectable.
Why the extra processing matters
Triage takes longer. It searches wider.
A fast Agent start follows bounded evidence. Triage keeps working across the capture, using known investigation patterns and protocol knowledge to find correlations the Agent may not know to request on its own.
- 01Open firstStart working before the deeper search is finished.
The PCAP becomes safely readable first. PacketSafari Triage can keep processing without blocking packet-level inspection.
- 02Search broadlySpend more time finding sparse, capture-wide signals.
Triage maps connections and protocols, activates relevant specialists, correlates findings, and preserves exact packet pivots across small and very large captures.
- 03Give Agent evidenceSurface clues a bounded fast start may not retrieve.
Agent receives a reusable evidence map with prioritized signals and exact frames instead of having to guess where the important packets are.
Thorough does not mean indiscriminate: traffic, capture size, policy, and the selected workflow determine which specialists run. Security and rule analysis can use loaded Suricata-compatible feeds; authoritative every-packet rule coverage remains an explicit full-scan option.
Triage and AI
Choose when Agent receives the wider evidence map.
PacketSafari Core Engine prepares evidence. Agent investigates and explains it. Preliminary direction and later verification remain separate outcomes.
Compare investigation workflows01 Fast answer
Agent can begin as soon as the capture is safely readable.
Triage is optional and can continue after the preliminary result.
Fastest direction with bounded context.02 Fast + verification
RecommendedA preliminary Agent starts while Triage builds the wider evidence map.
A related verifier later checks strong candidates against broader evidence.
Direction now, then an explicit verification outcome.03 Triage then deep
The first Agent report waits for the Triage evidence map.
Capture-wide signals and correlations are available before deep reasoning starts.
Widest first-pass context with the longest wait.
Private by deployment
Build the evidence map inside your boundary.
On-premises deployments keep packet storage, identity, retention, processing, and egress policy under customer control. Agent receives bounded evidence through the approved deployment path—not an unrestricted copy of the capture.
Explore private deploymentYour storage
PacketSafari Triage
Approved AI
Bring a difficult capture