Drag and drop packets into the correct chronological order · Identify C2 beacons, exfil, and lateral movement