Every connection a sandboxed seat or command makes on the Mac goes through the app's egress proxy, and the proxy keeps a record of the run. The Network row of the run's Summary shows it, and the same record goes to the audit log as egress.connections.
What it holds
The record always names every host the sandbox saw, allowed or refused. With Record what each connection carried on (Settings → Workspace → Approvals & safety nets; on by default) it also keeps, for each allowed connection:
- how many bytes went out and how many came back
- how long the connection lasted
- when it began
From those the Summary and the audit log can say two things a list of hosts cannot: that a destination mostly received uploads, and that a destination was contacted on a steady rhythm. A run started by a loop or a schedule says the rhythm is expected, so a check every ten minutes is not read as a beacon.
What it never holds
Never a path, a query string or a byte of a request or response body, whichever way the switch is set. The record is about where data went and how much, not what it said. Switch it off and the record keeps hosts only.
When to use it. Leave it on. A seat that sent a hundred megabytes to a host it was allowed to reach is something you want to see in the Summary, and the extra is a few numbers per connection.
When not to use it. A team whose policy keeps audit records to the minimum can turn it off; the host list stays either way.
Further reading. MITRE ATT&CK: Exfiltration Over C2 Channel — MITRE, on why sizes and rhythm matter.