A security analyst notices that a workstation is periodically sending encrypted traffic to an unfamiliar external IP address on port 443. Firewall logs show only source, destination, and port information, which does not reveal what data is being transmitted. The analyst needs to examine the actual contents of the packets to determine whether sensitive data is being exfiltrated. Which data source should the analyst use?