Wire data is network traffic that has been captured and reconstructed into structured records, such as sessions, flows, metadata, or parsed protocol events. Instead of keeping only raw packets, a platform turns traffic into searchable evidence that analysts can inspect, correlate, and preserve for investigation.
In cyber security, wire data matters because attacks often leave traces on the network even when endpoint controls miss the first move. It can reveal command-and-control traffic, lateral movement, data exfiltration, and unusual protocol use. Defenders use wire data in NDR, incident response, and forensics to rebuild what happened, compare activity against expected behavior, and support alerts with context. The main tradeoff is visibility versus volume: more reconstruction gives better detail, but it also requires strong collection, storage, and tuning to avoid noise and blind spots.