• Several of the events occurred shortly after a high volume of malformed or suspicious SSLVPN requests, including path-traversal patterns