Analyst examining network traffic evidence