What on this network is calling home on a timer BEACON
Command and control is a heartbeat. Nothing a person does is regular to the second, and nothing a spreadsheet does will show you which of four thousand pairs has one.
The log
The time column takes an ISO timestamp, a date and time separated by a space, or a bare epoch in seconds or milliseconds. A connection log is a map of an entire organisation; this one is read by the browser on this device and is not sent anywhere.
What has the shape
Period is the median gap between connections. Jitter is how much the gaps vary, doubled, because an implant sleeping for a set time plus or minus a percentage produces gaps spread evenly over that range, whose median absolute deviation is exactly half the percentage. In band is the share of gaps landing close to the median. Size cv is how much the conversation size varies, where zero means every check-in is identical.
The gaps, drawn
The analysis
How it works
Malware that calls home to a command server does it on a timer, and nothing a person does is regular to the second. BEACON reads network connection logs and finds hosts contacting the same destination at steady intervals, allowing for jitter, using a robust measure of spread rather than an average that one outlier can skew. It flags candidates for a person to check; it does not decide what is malicious. The logs stay in this tab.
Doing this often? The Sovereign Console loads logs, captures and files into one case, pulls every indicator and timestamp, and exports a report. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.