An endpoint agent configured, when executed on an endpoint device, to: access via a local traffic access function of the endpoint device network traffic local to the endpoint device, the local network traffic comprising: copies of all outgoing packets sent from a network interface of the endpoint device to a packet-switched network and carrying in their payloads outbound payload data generated by one or more processes executed on the endpoint device, and copies of all incoming packets received at the network interface from the packet-switched network and carrying in their payloads inbound payload data intended for the one or more processes executed on the endpoint device; extract network traffic telemetry from the headers and the payloads of the copies of the outgoing and incoming packets, the extracted network traffic telemetry including header data of the incoming and outgoing packets, and additionally summarizing the outbound and inbound payload data of the outgoing and incoming packets, wherein said extracting comprises processing each packet to determine whether the packet constitutes the start of a network flow or pertains to an existing network flow; and transmit, to a cybersecurity service, a series of network telemetry records identifying all new network flows observed by the endpoint agent, and containing the extracted network traffic telemetry that includes the header data and summarizes the payload data for use in performing a cybersecurity threat analysis. access via a local traffic access function of the endpoint device network traffic local to the endpoint device, the local network traffic comprising: copies of all outgoing packets sent from a network interface of the endpoint device to a packet-switched network and carrying in their payloads outbound payload data generated by one or more processes executed on the endpoint device, and copies of all incoming packets received at the network interface from the packet-switched network and carrying in their payloads inbound payload data intended for the one or more processes executed on the endpoint device; copies of all outgoing packets sent from a network interface of the endpoint device to a packet-switched network and carrying in their payloads outbound payload data generated by one or more processes executed on the endpoint device, and copies of all incoming packets received at the network interface from the packet-switched network and carrying in their payloads inbound payload data intended for the one or more processes executed on the endpoint device; extract network traffic telemetry from the headers and the payloads of the copies of the outgoing and incoming packets, the extracted network traffic telemetry including header data of the incoming and outgoing packets, and additionally summarizing the outbound and inbound payload data of the outgoing and incoming packets, wherein said extracting comprises processing each packet to determine whether the packet constitutes the start of a network flow or pertains to an existing network flow; and transmit, to a cybersecurity service, a series of network telemetry records identifying all new network flows observed by the endpoint agent, and containing the extracted network traffic telemetry that includes the header data and summarizes the payload data for use in performing a cybersecurity threat analysis.