The Cloud Collector also has the ability to store full packet captures (PCAPs) of all observed traffic. In Helix, you can generate PCAPs, review the transcript, and download PCAP files for further investigation.
Note
Before you can work with PCAPs in Helix, you must generate an API key and provide the key to Trellix. See the "PCAPs" section of the Helix Enterprise Administration Guide for details.