NetFlow
Who talked to whom, when, how much. Metadata, not payload. Cheap enough to keep.
NetFlow, and cousins such as IPFIX, records conversations: addresses, ports, bytes, packets, timestamps, sometimes application hints. It will not show the exploit string. It will show the beacon, the bulk egress, and the workstation that suddenly speaks administrative protocols everywhere.
Export from routers, switches, or a sensor. Enrich with DNS and identity if you can. Retention beats perfect detail you rotated out yesterday.
See also: Packet capture, Network detection and response, Beaconing, DNS.