Network Beaconing or Excessive Connection Attempts by FF-Agent
Detects excessive network activity patterns by ff-agent which may indicate beaconing or unauthorized scanning activity. Note that this rule requires a backend capable of correlation or statistical aggregation.
Sigma
