As it monitors traffic, the Network Security appliance archives and indexes metadata for layer 4 and layer 7 activity it observes. Later, when you expand an entry in the alerts list to view the alert details, the appliance queries the archive for information about the attacking host’s other network activity. This contextually related data—called related network activity—can help you to understand a SmartVision event and its base events. For more information, see Viewing network activity details for a SmartVision alert.
SmartVision appliances collect and display related network activity for alerts when the context service is enabled. The context service is enabled by default.