How to create extended packet captures for a specific vulnerability

Sometimes we suspect a Vulnerability signature is triggered for benign activity and we want to collect more information so we can submit a "False Positive Review" request. Instead of creating general policy to collect extended packet captures for a specific severity of vulnerability, as described in a configuration article found here, sometimes we need to create extended captures only for the specific purpose of submitting a false positive report.
 

For such action, we need to create a specific Vulnerability Protection Exception within the Vulnerability Protection Profile we are using (by editing applicable Vulnerability Protection Profile or cloning 'default' or 'strict' profiles, as those cannot be edited).

Some threat signatures are detected during SSL decryption and running a standard packet capture would only capture encrypted SSL packets.
 

This feature allows for the extraction of the packets that caused signature triggers, even when the original traffic is encrypted and subsequently decrypted by the firewall.

Without this feature, the last resource options for encrypted/decrypted traffic are

• Implement a Decryption Port Mirror. The advantage with this option is that the decrypted packet capture can be exported and used for subsequent lab reproduction tests.
• If the application front-end is a Web Browser, Decrypt the session extracting the TLS keys. The disadvantage with this option is that the decryption session is only readable in Wireshark, and the decrypted packet capture cannot be exported.