Savvius Vigil integrates with Palo Alto Networks Next-Generation Firewall via syslog. When an alert is triggered by the firewall, the Savvius Vigil appliance captures the specific network traffic that caused the alert. Savvius Vigil continuously collects all network packets, receives security alerts generated by Palo Alto Networks PAN-OS® and only stores traffic associated with Palo Alto Networks security alerts, discarding unassociated packets. Savvius Vigil stores network traffic data from five minutes before through five minutes after the alert triggered.