Opening case…
Loading your run…
An internal LLM agent host is beaconing to an unknown external endpoint.
NDR flagged the agent-orchestrator host making periodic HTTPS calls to an unrecognized domain. The agent has tool access including a shell tool and an HTTP-fetch tool. The domain is newly registered.
index=ndr src_host=agent-orch-* | where dest_domain NOT IN (allowlist) | stats count sum(bytes_out) by dest_domain, dest_ip | where count > 5detection queryindex=ndr src_host=agent-orch-* | where dest_domain NOT IN (allowlist) | stats count sum(bytes_out) by dest_domain, dest_ip | where count > 5