Elastic low stable eql

Potential Data Exfiltration Activity to an Unusual IP Address

A machine learning job has detected data exfiltration to a particular geo-location (by IP address). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.

View Source

Detection Logic

Field Validations

Loading…

Comments (0)

Loading comments...