https://docs.paloaltonetworks.com/best-practices/10-2/data-center-best-practices/data-center-best-practice-securi The Palo Alto Networks Best Practices for Anti-Spyware Profiles recommend enabling single-packet captures (PCAP) for medium, high, and critical severity threats. This allows for capturing the first packet of the malicious traffic for further analysis and investigation. PCAP should not be enabled for low and informational severity threats, as they generate a relatively high volume of traffic and are not particularly useful compared to potential threats2. References: Create the Data Center Best Practice Anti-Spyware Profile, Security Profile:
Anti-Spyware, PCNSE Study Guide (page 57)