Logging attack context data

A non-transitory computer-readable storage medium tangibly embodying a set of instructions, which when executed by one or more processors of a firewall device, cause the one or more processors to perform a method comprising:

• receiving configuration information from a network administrator, the configuration information including a number (N) of packets to capture by the firewall device responsive to an event detected by the firewall device that is potentially indicative of a threat or undesired activity;
• receiving a plurality of packets;
• applying at least one attack detection algorithm to the plurality of packets, wherein the at least one attack detection algorithm comprises one or more of a set of intrusion detection signatures, a set of malware detection signatures and a set of security policies;
• and
• responsive to determining based on the at least one attack detection algorithm that a trigger packet of the plurality of packets is associated with a potential threat or potential undesired activity, causing information regarding N packets of the plurality of packets, inclusive of the trigger packet, to be stored in a log.