Network

Need	Open
Cross-source investigation flow	Network triage and correlation
Packets, sessions, and flow records	Packet and flow triage
Domain and resolver activity	DNS
Web requests and responses	HTTP
Certificates and encrypted sessions	TLS

Host/process + user + DNS + connection + TLS/HTTP + destination history