Filtering out IPS alerts with PCAP

[Norbert_Anderss]

Hi

Wondering if there is any way to filter out IPS alerts which have a pcap file attached in SmartLog? If not, is there any other way to see the pcap files, where are they stored? I'm running version r80.30 on the log server.
Best Regards
Norbert

[Timothy_Hall]

For R80.10+ gateways, IPS packet captures are automatically transferred to the Log Server (usually the SMS or CMA) and
stored in the $FWDIR/log/forensics and /var/spool/mail directories.