How can i find hosts connected to Monero crypto site

Hi.

Fortigate reports in its weekly reports that the monero.cryptocurrency.miner application has had a certain number of sessions open in the past (e.g. 1,790 sessions this week). I would like to trace where this traffic is coming from. How can I do this? In section "Log&report" a cannot find anything.