EBA: Rare External Destination Access by Server on events which are detected by the Local system
The QRadar® User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Rare External Destination Access by Server on events which are detected by the Local system
Enabled by default
True
Default senseValueDestination
0
Default senseValueSource
10
Description
Detects server systems communicating with previously unseen external destinations over common service ports (80, 443, 22, and 8080). The rule excludes known server-to-external communication patterns to highlight potentially suspicious outbound connections.
Support rules
- BB:UBA : Common Log Source Filters
- UBA : Server Identification
- UEBA : Server External Connections by Source IP - IP
Log source types
Firewall logs, Network Flow (NetFlow)