// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
1
event matches
Severity
- Critical0
- High0
- Medium1
- Low0
- Info0
Applied filters
- dstip = 104.28.211.19
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Medium | Data Egress | hlindqvist | 10.4.12.28 | allow tcp 10.4.12.28:49881 -> 104.28.211.19:443 bytes_out=1284739584 sni="upload.filetransfer.example" — destination unseen in prior 30 days |