Malicious IP Traffic
The Malicious IP Traffic dashboard helps you identify activity between known malicious IPs and your environment. It shows the top talkers, maps the worldwide locations of malicious IPs, and identifies the specific accounts, workloads, and protocols attackers target.
Important
Switching between flows and bytes may change your displayed results. For example, if a resource with denied traffic has a large number of flows but zero bytes, switching the displayed results from flows to bytes removes the resource from a Top 10 list due to the low byte count, replacing it with another resource that has a higher byte count.
How to Use Malicious IP Traffic Widgets
The widgets help you understand where Malicious IP Traffic are concentrated and how they change over time.
Note
Data shown in all widgets reflects the selected date range and any applied page-level filters.
Widget | Use Cases |
|---|---|
Top 10 Malicious IPs | Identify the most active malicious IPs communicating with your environment and determine if their activity is increasing.
|
Global Threat Map | Visualize the geographic origin of malicious IP activity and determine which countries pose the greatest volume of threat.
|
Top 10 Tenants with Malicious IP Flows | Scope the organizational impact of malicious IP activity by identifying which cloud subscriptions or tenants are most exposed to malicious IP communications.
|
Top Roles | Identify which types of workloads (by role label) are most involved in malicious IP communications.
|
Top 10 Services Used in Malicious IP Communication | Reveal which network services and protocols are being used in communications with malicious IPs, and spot whether any are showing abnormal traffic increases.
|
Traffic Table
View flow, IP, and resource details using slide-outs
Slide-outs provide additional information about specific flows, IP addresses, and resources. Click each to launch a slide-out and view additional details.