High Volume Outbound Network Connections

Ankit Mehta@Secvyn

•updated Jun 4, 2026•2•0•5

This rule detects devices making a high volume of outbound network connections (more than 1000 connections within a one-minute window) to a single remote IP address. This behavior could indicate a network denial-of-service (DoS) attack originating from the device, or potentially other forms of high-volume network activity such as data exfiltration or scanning.