HTTP/HTTPS requests (URLs, user agents, response codes) - Connection allow/deny decisions - Essential for tracing data exfiltration and C2 channels