A SOC analyst needs to identify which internal hosts communicated with a known malicious IP address over the past 30 days. Full packet capture storage was purged after 72 hours due to disk constraints, but the organization retains records showing source/destination IPs, ports, protocols, byte counts, and timestamps for all flows during that period. Which data type is the analyst relying on to answer this question?