This workflow shows two topology views. One with all connections for the past one hour, the other that has a suspected IP addresses on at least one end of the connection. The list of suspected IP addresses is controlled by an authorized user via uploading of suspected ip address list from Policy->Augmentation panel of the UI.