FR: network monitoring

[mgreen27]

We currently have a few artifacts to collect network traffic from the endpoint, but these are usually running another tool and a bit clunky. This feature request is for a process monitor like capability that may collect network packets and store a small cache ready to collect if desired from the endpoint.

Netresec has a tool called PacketCache that does this kind of workflow.
https://www.netresec.com/?page=PacketCache

Might be easier to do nowdays with eBPF.