EBA: Multiple Hosts Communicating with Suspicious External IP on events which are detected by the Local system
The QRadar® User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Multiple Hosts Communicating with Suspicious External IP on events which are detected by the Local system
Enabled by default
True
Default senseValueDestination
20
Default senseValueSource
10
Description
Detects potentially malicious external destinations by identifying a destination IP that is contacted by at least 30 different internal hosts within 15 minutes. Known trusted destination IPs are excluded from detection.
Support rules
- BB:UBA : Common Log Source Filters
- UEBA : Known Destination IPs - IP
Log source types
Firewall logs, Network Flow (NetFlow), Proxy logs