NetFlow
Summary records of network conversations (5-tuple, byte and packet counts, timestamps) exported by routers, firewalls or cloud platforms.
A flow record aggregates packets sharing a 5-tuple (source IP, destination IP, source port, destination port, protocol) into one line with start and end times, bytes and packets. Cisco's NetFlow v5 and v9 (RFC 3954) led to the IETF standard IPFIX (RFC 7011); cloud equivalents include AWS VPC Flow Logs and Azure NSG and VNet flow logs. Zeek's conn.log is a richer, sensor-generated cousin.
Flows are cheap to keep for months, unlike full packet capture, and answer the questions triage needs: who talked to this IP, how much data left, which hosts connect out every 60 seconds. They are the main source for beaconing, exfiltration and lateral movement analysis.
Limits: no payload, sampling on busy routers can hide small flows, and NAT can obscure the real internal host unless you join with NAT logs.