lol, XDR just alerted on my SSH tunnel I had open YESTERDAY. While I have multiple domains on my destination IP... and XDR agent is on my local desktop watching me ssh to $domain... it picked another domain of mine at random top claim I was ssh tunneled to. top notch reporting XDR