Demo

Scenario:

CRITICAL: Score 13 & 12 High threats — C2 beacon UNLOGGED BY FIREWALL detected on wire

Edit Query: 06-Beacon_30d_4h_n6

Name (unique) IP column name

Enabled 2-Stage Pre-filter (24h candidate extraction + batched 30d verification)

ESQL

Cancel