Web: Potential file transfer using SCP [splunk-edr]

`get_endpoint_data` `get_endpoint_data_edr` (TERM(ssh) 
AND TERM(scp))
| rex field=_raw (?<dest_ip>"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
| rex field=_raw max_match=2 "[^\w]"(?<process_name>"(ssh)
| (scp)")"[^\w]"
| rex field=_raw "[^/]"(?<process>"/([^/\)]+/)+ssh [^(a1=)].+")
| rex field=_raw "-l "(?<user>"[^\s\=]+")"\s"
| rex field=_raw "-p\s+"(?<dest_port>"\d{1,5}")"\s"
| regex process="(ssh
| scp)\s+"
| table _time, host, user dest_ip, dest_port, process, process_name, user
| bin span=1s
| stats values(*) as * by _time, host
| iplocation prefix=dest_ip_ dest_ip