Glossary: Logs and Data Sources for Investigations

Capture filter

A filter that decides which packets get saved in the first place, such as tcpdump's port 8080. Anything it leaves out is gone for good, so investigators capture broadly.