these evidence shouldn't both say "to" the same IP.

[AlyaGomaa]

2025-07-13T03:51:40.302809+00:00 (TW 10): Src IP 192.168.1.132 . Detected Large data upload. 557.757433 MBs sent to X threat level: info.
2025-07-13T03:51:40.302809+00:00 (TW 10): Src IP X . Detected Large data upload. 557.757433 MBs sent to X threat level: high.

one of them should say "from"