UDM search shows outbound connections from a production VM to an unfamiliar external IP over the last 48 hours. What is the quickest way to gather context and assess the IP's reputation?

• A. Examine SecOps Asset view details for the VM.
• B. Create a new detection rule to alert on future traffic from the IP.
• C. Search for the external IP in Alerts & IOCs in SecOps.
• D. UDM search to identify which user was logged in during connections.

Answer: (C)

When you see outbound connections to an unfamiliar external IP, you want immediate context about whether that IP is already known to be dangerous. The quickest path is to search for that external IP in Alerts & IOCs in SecOps. This area centralizes indicators of compromise and threat intelligence, so querying the IP surfaces whether it’s been seen before, what threats it’s associated with (malicious activity, botnets, C2 servers, phishing infrastructure, etc.), and any related alerts or enriched data. You can quickly assess risk, view cross-referenced alerts across the environment, and gather actionable context (like related assets or IOCs) without setting up new rules or digging through individual assets.

Looking at the VM’s asset details can reveal the machine’s properties but won’t directly tell you whether the IP is reputable. Creating a new detection rule helps for future traffic but doesn’t provide the immediate reputation context you need now. Trying to identify the logged-in user might help with attribution, but it doesn’t address the IP’s trustworthiness or threat level.