The 365-Day Rewind: Why Full Packet Capture Is the Only Answer to ‘Were We Actually Breached?’

The question every board asks, and most teams can’t answer

A threat intel feed flags an IP. A vendor discloses a vulnerability that was exploited for months before anyone noticed. A regulator, an insurer or your own board asks the same thing: were we actually breached, and what did they take?

Most security teams can’t answer with certainty. They can tell you a connection happened. They can’t tell you what was inside it.

Full packet capture changes that. It records the actual contents of network traffic, not just a summary of it, and lets investigators go back in time and replay exactly what crossed the wire. Retained for up to a year, it turns “we believe” into “we know.”

This is the 365-day rewind. Here’s why it matters and why so few managed detection and response providers offer it.

Metadata tells you a call was made. Packets let you hear it.

There are three common ways to see network activity after the fact. Only one of them can prove what was transferred.

Logs (firewall, proxy, SIEM) record events a device chose to record. They can prove a rule fired or a connection was allowed or blocked. They can’t prove anything the device didn’t log, and they’re useless if the attacker deleted them.

NetFlow and network metadata record who talked to whom, when, for how long and how many bytes moved. They can prove that Host A sent 4 GB to an external IP on a given night. They can’t tell you what those 4 GB were.

Full packet capture records the complete contents of each session. It can prove exactly which files, commands and data crossed the network. Only contents that stayed encrypted are out of reach, and even then timing, fingerprints and volumes remain.

The gap between the second and third rows is where breach investigations stall. Metadata tells you something left the building. Packets let you extract the files, read the commands and reconstruct the attacker’s session.

That matters for a practical reason. Logs live on systems attackers can reach and tamper with. Packets captured by an independent network sensor record what the attacker did, whether or not they later cleaned up.

A note on encryption: most traffic today is TLS. Full packet capture still pays off there. Plenty of internal traffic (DNS, older SMB versions, legacy and OT protocols) is still unencrypted, and even encrypted sessions keep their certificates, fingerprints, timing and volumes, which are exactly what investigators use to separate beaconing malware from normal use.

Why a year of retention, not a week

Packet capture is only useful if the packets still exist when you need them. Most network forensics tools keep days or weeks of traffic, because full-fidelity storage is expensive. Attackers stay far longer than that.

• 247 days: the mean time to identify and contain a breach (IBM Cost of a Data Breach 2026)
• 122 days: the median dwell time for cyber espionage intrusions (Mandiant M-Trends 2026)
• Nearly 400 days: the dwell time reached by the BRICKSTORM campaign (Mandiant M-Trends 2026)
• 14 days, up from 11: the global median dwell time across all intrusions (Mandiant M-Trends 2026)

The median is improving for noisy attacks like ransomware. The intrusions that matter most to regulators and boards, the quiet ones, still run for months. Mandiant’s own guidance in M-Trends 2026 is that the standard 90-day log retention window leaves organisations unable to see initial access or the full scope of long-running intrusions.

IBM’s 2026 data puts a price on that delay: breaches with lifecycles over 200 days averaged $5.65 million, against $4.32 million for those contained faster.

Who needs the answer, and how fast

• Regulators. US public companies must file an SEC Form 8-K within four business days of deciding an incident is material. GDPR gives 72 hours to notify a supervisory authority. Neither deadline waits for a long forensic reconstruction.
• Insurers. Cyber claims turn on scope: what was accessed, when it started and whether data left. Packets are evidence; inference from logs is an argument.
• Boards and customers. “No evidence of exfiltration” means something very different when you have the packets to prove it versus when you simply have no data.

When an intrusion is discovered months after it began, a year of retained packets means the beginning of the story is still on disk.

How LMNTRIX delivers full packet capture and network forensics

Most MDR providers stop at endpoint telemetry and log correlation. Some add NDR built on metadata. Very few retain full packets, and fewer still for a year. At LMNTRIX, full packet capture is a native module of our XDR platform, run by our own analysts as part of managed detection and response.

• Up to 365 days of full-fidelity retention. Packets, extracted files and session data are kept long enough to cover the dwell times that actually occur.
• Our sensors, behind your stack. We don’t rely on logs from your firewall, EDR or SIEM vendor. Our network sensors sit behind your existing controls, so the evidence is independent of the tools an attacker may have already bypassed or tampered with.
• Retrospective hunting. When a new indicator or vulnerability is published, we search back through months of packets to see whether it was used against you before anyone knew to look.
• Packets as one of nine hunting vectors. Packet data feeds our 450+ automated hunts alongside endpoint, network, identity, cloud, email, deception, OT and threat intelligence.
• Forensics included, not billed. Network forensics sits alongside unlimited DFIR in every subscription. You don’t open a retainer to find out what happened.
• Detection that acts. Threat intelligence from our investigations is pushed to Palo Alto, Fortinet, Cisco and Check Point firewalls, with 850M+ IOCs auto-blocked via API every 5 minutes.

A typical rewind

1. A vendor discloses that a VPN appliance flaw has been exploited in the wild since spring.
2. Our analysts pull every session to and from that appliance over the past year.
3. Packets show the exploit attempt, the follow-on connections and whether any data moved, and the files involved if it did.
4. You get an answer backed by evidence: affected, with scope; or not affected, with proof.

Questions to ask any MDR provider about network forensics

1. Do you capture full packets, or only flow data and metadata?
2. How long are packets retained, and is that included or an add-on?
3. Are the sensors yours, or do you rely on my vendors’ logs?
4. Who performs the forensic analysis, and is it billed by the hour?

Frequently asked questions

What is full packet capture? Full packet capture (FPC) records the complete contents of network traffic, not just metadata about it. Investigators can replay sessions, extract transferred files and see exactly what an attacker did on the network.

What is the difference between full packet capture and NetFlow? NetFlow records who communicated, when and how much data moved. Full packet capture records what was actually sent. NetFlow can show that 4 GB left your network; packets show what those 4 GB were.

How long should packet capture data be retained? Long enough to cover realistic dwell times. Mandiant’s M-Trends 2026 reports a median of 122 days for espionage intrusions and one campaign reaching nearly 400 days, so retention measured in weeks often misses the start of an intrusion. LMNTRIX retains full packets for up to 365 days.

Which MDR/XDR vendors offer full packet capture and network forensics? Few MDR providers include full packet capture as a managed capability. LMNTRIX includes full packet capture with up to 365-day retention and network forensics as native parts of its XDR platform and MDR service, with forensic analysis performed by its own analysts and DFIR included in every subscription.

Does full packet capture work on encrypted traffic? Partly. Encrypted payloads stay encrypted, but certificates, fingerprints, timing and volumes are still captured, and much internal traffic remains unencrypted. Those signals are enough to detect command-and-control beaconing and abnormal data transfers.

Stop guessing. Rewind.

“No evidence of compromise” should mean you looked and found nothing, not that there was nothing to look at. A year of full packets is the difference.

See it in your own environment. Our free 30-day proof of concept deploys LMNTRIX sensors, including full packet capture, behind your existing controls, with our SOC hunting from day one. Talk to LMNTRIX.