Telemetry
What is PCAP?
Packet capture: a file containing raw network traffic as it crossed the wire, which tools like Wireshark can replay and decode.
A PCAP is a file containing captured network packets, in the pcap or pcapng format. It holds the full traffic, headers and payloads, as it crossed the network during the capture.
Full packet capture is the most complete network evidence but takes a lot of storage, so most organisations keep it only briefly or only at key points. Sandboxes and labs commonly provide PCAPs of malware traffic for analysis.