New Outbound SSH Traffic to an Unusual Location Activity

There are legitimate reasons why a user could establish an SSH connection to an external server for the first time, but a connection to an unusual location might indicate that an attacker has compromised this device. The immediate impact to a business can be low, but the ultimate objective of an attack, such as data exfiltration, could have a significant impact on a business or organization.

The system might change the risk score for this detection.