A method comprising: receiving, by a computing device located at a boundary between an enterprise network and an unprotected network, a plurality of threat indicators from a plurality of threat intelligence providers, wherein the plurality of threat indicators comprise Internet Protocol, IP, addresses, uniform resource identifier, URI, addresses, hostnames, or fully-qualified domain names, FQDNs; generating, by the computing device, one or more packet filtering rules based on the plurality of threat indicators by: combining a first threat indicator of the plurality of threat indicators with a second threat indicator of the plurality of threat indicators, wherein the first threat indicator is associated with a different threat intelligence provider of the plurality of threat intelligence providers than the second threat indicator; generating at least a first packet filtering rule configured to filter packets associated with the combined first threat indicator and second threat indicator; and assigning a packet capture directive to the first packet filtering rule; filtering, by the computing device, on a packet-by-packet basis, and based on the one or more packet filtering rules, one or more packets received by the computing device; capturing, by the computing device and based on the packet capture directive, at least one of the one or more packets filtered by the computing device based on determining that the at least one of the one or more packets matches the combined first threat indicator and second threat indicator of the first packet filtering rule; and generating, by the computing device and for the captured at least one of the one or more packets, a packet capture file comprising: raw packet content, and threat context information. receiving, by a computing device located at a boundary between an enterprise network and an unprotected network, a plurality of threat indicators from a plurality of threat intelligence providers, wherein the plurality of threat indicators comprise Internet Protocol, IP, addresses, uniform resource identifier, URI, addresses, hostnames, or fully-qualified domain names, FQDNs; generating, by the computing device, one or more packet filtering rules based on the plurality of threat indicators by: combining a first threat indicator of the plurality of threat indicators with a second threat indicator of the plurality of threat indicators, wherein the first threat indicator is associated with a different threat intelligence provider of the plurality of threat intelligence providers than the second threat indicator; generating at least a first packet filtering rule configured to filter packets associated with the combined first threat indicator and second threat indicator; and assigning a packet capture directive to the first packet filtering rule; combining a first threat indicator of the plurality of threat indicators with a second threat indicator of the plurality of threat indicators, wherein the first threat indicator is associated with a different threat intelligence provider of the plurality of threat intelligence providers than the second threat indicator; generating at least a first packet filtering rule configured to filter packets associated with the combined first threat indicator and second threat indicator; and assigning a packet capture directive to the first packet filtering rule; filtering, by the computing device, on a packet-by-packet basis, and based on the one or more packet filtering rules, one or more packets received by the computing device; capturing, by the computing device and based on the packet capture directive, at least one of the one or more packets filtered by the computing device based on determining that the at least one of the one or more packets matches the combined first threat indicator and second threat indicator of the first packet filtering rule; and generating, by the computing device and for the captured at least one of the one or more packets, a packet capture file comprising: raw packet content, and threat context information. raw packet content, and threat context information.