An outbound connection from a production VM to an unfamiliar external IP is observed. Which action is the quickest to gather context and assess IP reputation?

• A. Examine SecOps Asset view details for the VM.
• B. Search for the external IP in Alerts & IOCs in SecOps.
• C. Create a new detection rule to alert on future traffic from the IP.
• D. UDM search to identify which user was logged in during connections.

Answer: (B)

When you see a production VM talking to an unfamiliar external IP, you want rapid context about that endpoint. The fastest way to do this is to search for the external IP in Alerts & IOCs. This repository is designed to surface known indicators of compromise and their associated context—previous alerts, investigations, and reputation data—so a quick lookup can reveal whether the IP is linked to malware, C2 activity, or known campaigns. If the IP already appears in IOCs, you gain immediate guidance on whether to block, monitor, or investigate further, and you may find related artifacts that point to a broader threat.

Examining the VM’s asset details helps you understand the host’s configuration and risk posture, but it doesn’t directly tell you about the external IP’s reputation. Creating a new detection rule is proactive and useful for future traffic, but it doesn’t provide the immediate context needed for quick triage. Identifying the user logged in during the connection can aid internal attribution, yet it doesn’t address the external IP’s credibility or risk, which is the critical first step in rapid assessment.