When does IR teams typically perform network forensics during an incident?

I thought incidents had already happened, so there should only be a few network-related artifacts left unless attackers are still active in the system and you are lucky enough to be able to capture them.

- When do you capture traffic?
- How do you capture it?
- Do you only analyze malware traffic from the sample?
- Do you rarely do network forensics nowadays?

artifacts attackers capture cybersecurity forensics incident incidents network network forensics system teams thought traffic