Suspicious outbound network traffic via VPC Flow Logs for the past day
The query, as constructed, is primarily focused on detecting large outbound traffic volumes to external destinations on a per source-destination pair basis within daily aggregations. Adjust the threshold and aggregation criteria based on your specific security requirements and typical network behavior patterns.
Microsoft Sentinel (KQL)
