Demo

Scenario:

CRITICAL: Score 13 & 12 High threats — C2 beacon UNLOGGED BY FIREWALL detected on wire

Edit Query: 04-Beacon_30d_2h_n12

Name (unique) IP column name

Enabled 2-Stage Pre-filter (24h candidate extraction + batched 30d verification)

ESQL

Cancel