You can configure the Security Agent to notify end users whenever the endpoint attempts to contact a known C&C server.