Skip to content
Last update: 2022-05-12

New Outbound Host Connections

You can view new outgoing traffic by querying Sophos Linux Sensor's connection events. The query will return new outbound host connections that have been seen in the last 24 hours.

Required Tables

  • connections

Returned fields

Field Description
dst_addr The address that was accessed
occurrences How many times
dt The average access datetime

Query

SELECT dst_addr,
    COUNT(1) as occurrences, 
    FROM_UNIXTIME(AVG(unix_nano_timestamp)/1e9) as dt
FROM connections b
WHERE (
    SELECT COUNT(1) 
    FROM connections a 
    WHERE a.dst_addr = b.dst_addr and a.unix_nano_timestamp < TO_UNIXTIME(NOW()) * 1e9 - 60*60*24*1e9) = 0
GROUP BY dst_addr
Back to top