Hello Team,
As I am new to Cisco StealthWatch I received an alert as a workstation had a sudden increase in internal connections. This alert uses the Record Metric Outlier observation and may indicate internal scanning activity or attempted lateral movement.
Could you please help me out on how to check this?
