Network Connection to High-Confidence ThreatView Domain
This rule detects successful network connections from devices to domains identified as high-confidence threats by ThreatView.io. It specifically looks for outbound connections to public IP addresses where the remote URL's domain matches an entry in the ThreatView high-confidence feed.
Microsoft Sentinel (KQL)
