drop sysmon event 3 or netstat csv · periodic outbound connections per process · interval and jitter stats · beacon score 0–100 · runs locally
network csv
drop sysmon e3 / netstat csv
or click
groups by process + destination · needs ≥5 connections per group
drop sysmon event 3 or netstat csv