An apparatus arranged to identify, in packet-based traffic data received from a data communications network, actionable data packets, the apparatus comprising: a network interface; hardware search engine logic having a bit pattern storage memory array for storing one or more predetermined bit patterns, arranged to map bit sequences in data packets received at the network interface to stored bit patterns to thereby identify actionable data packets; a delay buffer having an input for receiving data packets from the network interface and for outputting the received data packets at each of a plurality of tap points, each tap point outputting the received data packets with a different length of time determined by operation of delay output and total capacity of the delay buffer; a control interface for communicating with one or more software applications; and hardware processing logic for controlling data flows within the apparatus and over the control interface, wherein the hardware processing logic is arranged, in respect of the control interface, to perform at least one of the following: to supply actionable data packets identified by the hardware search engine logic for security analysis; to supply data packets being output from one or more of the plurality of tap points of the delay buffer for security analysis; to receive configuration instructions to thereby update the bit pattern storage memory; and to receive tasking instructions to trigger one or more further searches by the hardware search engine logic of the received data packets being output by the delay buffer to search for further actionable data packets. a network interface; hardware search engine logic having a bit pattern storage memory array for storing one or more predetermined bit patterns, arranged to map bit sequences in data packets received at the network interface to stored bit patterns to thereby identify actionable data packets; a delay buffer having an input for receiving data packets from the network interface and for outputting the received data packets at each of a plurality of tap points, each tap point outputting the received data packets with a different length of time determined by operation of delay output and total capacity of the delay buffer; a control interface for communicating with one or more software applications; and hardware processing logic for controlling data flows within the apparatus and over the control interface, wherein the hardware processing logic is arranged, in respect of the control interface, to perform at least one of the following: to supply actionable data packets identified by the hardware search engine logic for security analysis; to supply data packets being output from one or more of the plurality of tap points of the delay buffer for security analysis; to receive configuration instructions to thereby update the bit pattern storage memory; and to receive tasking instructions to trigger one or more further searches by the hardware search engine logic of the received data packets being output by the delay buffer to search for further actionable data packets. to supply actionable data packets identified by the hardware search engine logic for security analysis; to supply data packets being output from one or more of the plurality of tap points of the delay buffer for security analysis; to receive configuration instructions to thereby update the bit pattern storage memory; and to receive tasking instructions to trigger one or more further searches by the hardware search engine logic of the received data packets being output by the delay buffer to search for further actionable data packets.