I've noticed some unexpected network activity in the Network Intelligence Center (NIC) but cannot find the details such as source ip address. Do I have to query network flow logs for this? It seems like there ought to be a drill down in NIC for this.
More details, by-request.... In the Network Topology tool I found an vm/node in our Google Cloud GCE project that was being accessed from another country with significant number for the rate of bytes transferred (out). That connection is outside the norm, hence I found it suspicious. And, I want to know more about the connection: for example, and IP address