Hello,
I am seeing unknown TCP connections in auditbeat when processing or publishing events in v6.7 but there is no such unknown connections in v7+. Is it correct old version behavior and what is it used for?
Here is the screenshot in v6.7 the port 8889 is correct one
