High Volume Outbound Network Traffic to Remote IP

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•3

This rule detects devices exhibiting high volume outbound network traffic, specifically more than 10MB of data transferred across more than 100 sessions to a single remote IP address within a one-minute window. This behavior can be indicative of data exfiltration, unauthorized data transfer, or other suspicious network activity.