Overview

Last 24 hours · Jul 07, 2026 00:09 – Jul 08, 2026 00:09 UTC Generated: 2026-07-08 00:09:10 UTC

Total Traffic (GB)

847.30

Outbound (GB)

312.80

Inbound (GB)

534.50

Total Flows

2,847,392

Events/Min

5,787

Top Assets by Risk

Internal hosts ranked by blended risk across the five detection lenses — Alert, Reputation, Anomaly, Behavioral, Performance. Click ▸ on any asset for the per-lens evidence.

Token classesbaselineBEBenignearlyRCReconnaissanceRDResource DevelopmentfootholdIAInitial AccessEXExecutionPEPersistenceDEDefense EvasionlateLMLateral MovementCOCollectionterminalEFExfiltrationIMImpact

Risk	Host	Signals	Evidence
97	10.0.42.118	iForestBehavioralAlertReputationPerformance	behavior on bytes_outbound deviates from baseline (score 0.91); matched LMLateral Movement (elevate_to_preintrusion, 8 times); behavior sequence ~0.01% likely vs history; 14 Suricata IDS hit(s)	▸
iForest 0.910 anomaly score (higher = more deviant) bytes_outbound0.420 dst_port_entropy0.310 peer_count0.180 Behavioral · Tactic + Sequence 24 total hits 8 elevated 9.20 max surprisal Top token: LMLateral Movement · elevate_to_preintrusion Alert · Suricata IDS 14 hits 6 unique SIDs sev 1 max severity → Open in Alerts
82	10.0.42.203	iForestBehavioralReputation	behavior on beacon_score deviates from baseline (score 0.84); matched EXExecution (elevate_to_preintrusion, 6 times); behavior sequence ~0.04% likely vs history	▸
iForest 0.840 anomaly score (higher = more deviant) beacon_score0.510 dns_unique0.280 tls_ja3_div0.130 Behavioral · Tactic + Sequence 18 total hits 6 elevated 7.80 max surprisal Top token: EXExecution · elevate_to_preintrusion Alert · Suricata IDS no Suricata alerts
52	10.0.31.84	BehavioralAlert	matched IAInitial Access (elevate_to_preintrusion, 4 times); behavior sequence ~0.02% likely vs history; 22 Suricata IDS hit(s)	▸
iForest no anomaly detection Behavioral · Tactic + Sequence 15 total hits 4 elevated 8.50 max surprisal Top token: IAInitial Access · elevate_to_preintrusion Alert · Suricata IDS 22 hits 9 unique SIDs sev 1 max severity → Open in Alerts
47	10.0.18.247	iForestBehavioral	behavior on peer_count deviates from baseline (score 0.72); behavior sequence ~0.22% likely vs history	▸
iForest 0.720 anomaly score (higher = more deviant) peer_count0.410 port_entropy0.280 bytes_internal0.150 Behavioral · Tactic + Sequence 4 total hits 0 elevated 6.10 max surprisal Top token: RCReconnaissance · present Alert · Suricata IDS no Suricata alerts
35	192.168.4.13	iForestBehavioral	behavior on dns_nx_rate deviates from baseline (score 0.38); matched COCollection (investigate, 2 times)	▸
iForest 0.380 anomaly score (higher = more deviant) dns_nx_rate0.390 dns_qtype_div0.270 dns_unique0.210 Behavioral · Tactic + Sequence 6 total hits 2 elevated 3.80 max surprisal Top token: COCollection · investigate Alert · Suricata IDS no Suricata alerts
34	10.0.42.142	iForestPerformance	behavior on tls_ja3_div deviates from baseline (score 0.68)	▸
iForest 0.680 anomaly score (higher = more deviant) tls_ja3_div0.360 cert_age_days0.240 sni_entropy0.180 Behavioral · Tactic + Sequence no behavioral detections Alert · Suricata IDS no Suricata alerts
27	10.0.31.92	BehavioralAlert	matched PEPersistence (investigate, 1 times); 11 Suricata IDS hit(s)	▸
iForest no anomaly detection Behavioral · Tactic + Sequence 3 total hits 1 elevated 4.20 max surprisal Top token: PEPersistence · investigate Alert · Suricata IDS 11 hits 4 unique SIDs sev 2 max severity → Open in Alerts
21	10.0.18.213	Behavioral	behavior sequence ~0.08% likely vs history	▸
iForest no anomaly detection Behavioral · Tactic + Sequence 2 total hits 0 elevated 7.10 max surprisal Top token: EFExfiltration · present Alert · Suricata IDS no Suricata alerts
26	10.0.42.97	iForestAlertReputation	behavior on bytes_total deviates from baseline (score 0.32); 8 Suricata IDS hit(s)	▸
iForest 0.320 anomaly score (higher = more deviant) bytes_total0.480 flow_count0.220 peer_count0.140 Behavioral · Tactic + Sequence no behavioral detections Alert · Suricata IDS 8 hits 3 unique SIDs sev 2 max severity → Open in Alerts
16	10.0.18.92	iForestBehavioral	behavior on dns_nx_rate deviates from baseline (score 0.41)	▸
iForest 0.410 anomaly score (higher = more deviant) dns_nx_rate0.390 dns_qtype_div0.270 dns_unique0.210 Behavioral · Tactic + Sequence 1 total hits 0 elevated 0.00 max surprisal Top token: RCReconnaissance · present Alert · Suricata IDS no Suricata alerts
9	10.0.31.108	iForest	behavior on tls_ja3_div deviates from baseline (score 0.22)	▸
iForest 0.220 anomaly score (higher = more deviant) tls_ja3_div0.360 cert_age_days0.240 sni_entropy0.180 Behavioral · Tactic + Sequence no behavioral detections Alert · Suricata IDS no Suricata alerts
5	192.168.4.27	BehavioralAlert	5 Suricata IDS hit(s)	▸
iForest no anomaly detection Behavioral · Tactic + Sequence 4 total hits 0 elevated 0.00 max surprisal Top token: BEBenign · suppress_known Alert · Suricata IDS 5 hits 2 unique SIDs sev 3 max severity → Open in Alerts

Detection Lenses

Each lens contributes to an asset's blended risk. The chips on an asset name the lenses that fired; an asset lighting up across multiple lenses outranks any single-lens hit.

ReputationExternal reputation — IP lookups against AbuseIPDB. Answers: "is this destination known-bad according to external threat intelligence?"

AlertKnown threats — Suricata signature matches. Answers: "is this a fingerprint of an attack someone has named?"

iForestStatistically unusual hosts — per-host outlier scoring via iForest (Isolation Forest). Answers: "does this host look different from the population?"

BehavioralNovel behavior sequences — OCCAM engine. Per-15-min ATT&CK tactic classification + HMM sequence prediction. Answers: "does the order of behaviors on this asset look like an intrusion unfolding?"

HuntFlow-pattern queries — rockfish-hunt engine. Heuristic analysis over flow data for beaconing, lateral movement, fanout, port scanning, and community-cluster shapes. Answers: "does this flow fit a known C2/scan/lateral pattern right now?"

PerformanceDrift from normal — per-asset baseline drift and SLA breaches over 15-min windows. Answers: "has this asset started behaving differently from its own past?"

Global Connections

Global Connection Map

Top Detections by Flow

Individual detections across all lenses, ranked by severity — each with its source → destination pair.

Severity	Lens	Source → Destination	Detection
0.93	Anomaly	10.169.112.51 → 104.18.32.68	iForest per-flow outlier (score 0.93)
0.90	Alert	10.1.12.88 → 45.142.213.18	ET TROJAN C2 Beacon HTTP Pattern (severity 1)
0.88	Reputation	10.1.12.88 → 45.142.213.18	Known C2 infrastructure (drep 96)
0.86	Behavioral	10.1.8.50 → 10.10.50.12	OCCAM pre-intrusion path (elevate)
0.85	Alert	10.1.8.50 → 8.8.8.8	ET MALWARE DNS Tunneling Detected (severity 1)
0.80	Alert	185.220.101.34 → 10.1.8.22	ET EXPLOIT SMB Remote Code Exec (severity 1)
0.78	Behavioral	10.1.12.88 → 45.142.213.18	Beaconing to external host (hunt)
0.72	Alert	203.0.113.5 → 10.10.50.12	ET SCAN RDP Brute Force Attempt (severity 2)
0.71	Anomaly	10.4.18.15 → 162.247.74.27	iForest per-flow outlier (score 0.71)
0.68	Performance	10.1.12.100 → 52.96.166.130	Critical — TCP reset storm (state critical)
0.66	Behavioral	10.1.8.22 → 10.10.1.5	Lateral movement over SMB (hunt)
0.64	Reputation	10.6.19.21 → 89.248.165.12	Active scanner (drep 74)
0.60	Anomaly	10.1.40.22 → 23.235.46.133	HBOS host drift (score 0.60)
0.54	Behavioral	10.1.40.22 → 10.10.1.5	SIGMA: suspicious PowerShell (sigma)
0.52	Reputation	10.20.5.18 → 185.220.101.34	Spam source (drep 58)

Event Type	Total	Unique Sources	Unique Destinations
flow	2,847,392	1,284	18,472
dns	1,523,847	892	142
tls	948,271	743	12,384
alert	12,847	234	1,892
http	384,291	521	8,743

Flow Orientation

Traffic direction relative to HOME_NET.

Direction	Flows	Traffic (GB)	Sources	Destinations
internal to internal	1,982,473	548.20	842	987
internal to external	612,847	218.40	1,184	8,473
external to internal	218,493	74.80	3,412	284
external to external	33,579	5.90	412	847

Top 10 Talkers

Source IP	Flows	Total GB	Out GB	In GB	Unique Dests
10.1.8.50	284,392	82.40	31.20	51.20	4,827
10.1.8.13	198,472	64.70	28.90	35.80	3,284
10.169.112.51	172,384	52.30	19.40	32.90	2,847
10.1.12.100	148,291	41.80	15.70	26.10	2,192
10.169.111.12	124,837	38.20	14.30	23.90	1,847
10.1.8.22	98,472	29.40	11.20	18.20	1,523
10.6.19.21	84,291	24.80	9.70	15.10	1,284
10.1.8.35	72,384	21.30	8.40	12.90	1,092
10.169.112.15	64,827	18.70	7.10	11.60	943
10.1.12.88	52,948	15.20	5.80	9.40	847

Top External Destinations

Destination	Country	Organization	Clients	Sent MB	Recv MB
13.107.42.14	US	Microsoft	312	2,847.3	8,472.1
142.250.80.46	US	Google	284	1,923.4	6,284.7
104.18.32.68	US	Cloudflare	247	1,284.8	4,827.3
52.96.166.130	US	Amazon AWS	198	984.2	3,284.1
151.101.1.140	US	Fastly	176	847.3	2,847.6
185.199.108.153	NL	GitHub	142	623.4	1,847.2
172.217.14.99	US	Google	118	492.8	1,284.3
23.235.46.133	US	Verizon Digital	98	384.2	984.7
198.41.128.100	DE	Cloudflare	84	287.3	847.2
93.184.216.34	EU	Edgecast	72	234.1	623.4