vpn_usage_internal_external
Explanation
vpn_usage_internal_external is a Netography Fusion Portal security event designed to detect VPN usage exiting a customer's network.
What to Look For
When examining the results of the vpn_usage_internal_external NDM, customers should look for any traffic leaving their network that shows signs of VPN usage. This could include unusual traffic patterns or connections to known VPN endpoints. Customers should examine network logs and endpoint device activity to determine the source of the VPN connection and take appropriate remedial action if necessary.
Related MITRE ATT&CK Categories
Updated 13 days ago