cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1103
Views
5
Helpful
0
Replies

Record Metric Outlier observation- Stealthwatch alert

pavan1989
Level 1
Level 1

Hello Team,

 

As I am new to Cisco StealthWatch I received an alert as a workstation had a sudden increase in internal connections. This alert uses the Record Metric Outlier observation and may indicate internal scanning activity or attempted lateral movement.

 

Could you please help me out on how to check this?

0 Replies 0