Connection metadata (duration, bytes, protocol) - HTTP details (URIs, user agents, referrers) - DNS queries and responses - TLS certificate information - File transfer metadata including hashes - Protocol-specific details (SMB, SSH, SMTP)