External Data Transfer
Use these insights to discover potential data exfiltration. Look for large volume data transfers and workloads associated with them. View the Now and Previous flow and byte count deltas to spot traffic increases.
Data Transfers by Destination Category
See data transfer by different destination categories such as cloud storage, malicious, application, cloud service provider, and others.
Data Transfers by Services
See data transfers to external destination IPs broken down by services within your environment. Click on the expansion icon to see data transfers by port and protocol combinations.
Top Source Role with Data Transfer
See data transfer to external destination IPs broken down by role labels (LDAP, NFS, and more) associated with your resources View the pie chart to see the amount of data transferred by each source role.
Data Transfers to External Geos
See data transfer to external IPs broken down by external geographic locations receiving the most traffic from internal resources. Hover over a location to see Now and Previous traffic. Click the Expand to full screen icon for an expanded view to better analyze traffic.
Top Sources with Data Transfers
See data transfers to external destination broken down by internal resources sending the most traffic external IPs. Hover over a resource to see its details. Click a resource (or its checkbox) in the legend to remove or restore it in the graph, and click on a resource line in the graph to update the Traffic Query Results table.
Traffic Query Results
Filter traffic results by source IP, source zone, port, protocol, and much more. For example, filter the Source Zone column to see all of your Azure sources in one place.
NOTE: Switching between flows and bytes may change your displayed results. Suppose a resource with denied traffic has a large number of flows but zero bytes. In this case, switching the displayed results from flows to bytes would remove the resource from a Top 10 list due to the low byte count, replacing it with another resource that has a higher byte count.
View flow, IP, and resource details using slide-outs
Slide-outs provide additional information about specific flows, IP addresses, and resources. Click each to launch a slide-out and view additional details.