<131>Jul 26 18:51:01 oak-stw-prd1.acme.net Stealthwatch[24863]: CEF:0|Cisco|Stealthwatch|7.5.0|Notification:45|Data Exfiltration|4|msg=Indicates that an abnormal amount of data has been transferred to inside or outside hosts.:Observed 199.11k points. Expected 0 points, tolerance of 95 allows up to 32k points. dst=226.105.73.126 src=250.200.111.227 start=2024-07-26T13:40:00Z end= externalId=8D-1K6V-DICY-SF0D-E cs3=Kedzie,Users cs3Label=SourceHostGroups cs4= cs4Label=TargetHostGroups cs5=https://10.0.1.176/lc-landing-page/smc.html#/host/250.200.111.227 cs5Label=Source_URL cs6=https://10.0.1.176/lc-landing-page/smc.html#/host/226.105.73.126 cs6Label=Target_URL dpt= proto= dvchost=oak-stw-prd2 dvc=10.0.1.175 dvcpid=301 deviceExternalId=oak-stw-prd2 cs2= / / / cs2Label=SGTIdAndSGTName spt= destinationTranslatedAddress= destinationTranslatedPort= sourceTranslatedAddress= sourceTranslatedPort=
Product: cisco_stealthwatch
Vendor: cisco_stealthwatch