LiveAction Incident Response is a network forensics and investigation tool that uses continuous, always-on packet capture to provide analysts with a reliable, packet-level record of network activity for use during security incident investigations. The tool addresses the challenge of reconstructing security events by capturing and retaining full packet data, which serves as a ground-truth evidence source alongside traditional log files, authentication records, and NetFlow metadata. Security Operations (SecOps) analysts can use the platform to examine the specific packets associated with a security alert, enabling them to determine exactly what occurred during an incident. This packet-level visibility is intended to accelerate and improve the accuracy of incident response decisions. LiveAction integrates directly into the Splunk Observability platform, allowing analysts to pivot from a security alert directly into relevant packet data without leaving their existing security tooling. The product also exposes workflow APIs that enable third-party security vendors to embed network history and packet data into their own applications through the LiveAction Partner Program.