The lookup right before the download
A workstation downloaded a binary over plain HTTP. Use tshark on the saved capture to tie the DNS lookup to the download and pull out the URL and user agent.
Briefing
EDR quarantined a file on 10.0.20.15 a few seconds after the user opened an email attachment. The network sensor kept a short capture: /cases/ws15.pcap.
tshark -r reads a capture. -Y applies a display filter, and -T fields -e prints just the fields you name, one packet per line.
sensor-01 · Packet captures
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.