Refer to the exhibit.

The flow data in the exhibit shows multiple short-duration, high-volume HTTPS connections (443/TCP) from IP 10.10.10.10 to multiple destination IPs in the 50.10.10.0/24 network. All flows are 22 seconds long and transfer exactly 1.77M of data. This uniform behavior to a large set of IP addresses strongly indicates a Denial of Service (DoS) pattern, where an internal host (10.10.10.10) is overwhelming external systems in the 50.10.10.0/24 range.

The SCAZT guide (Section 6: Threat Response, Pages 114–117) explains how Secure Cloud Analytics uses NetFlow and behavioral modeling to identify such volumetric threats. Key identifiers include:

Same connection size (1.77M)

Multiple unique peer IPs in a single external subnet

Same destination port and protocol (HTTPS)

Zero TCP connections completed, indicating unacknowledged connections

This matches the behavioral pattern of a DoS originating from an internal host.