Do you mean the destination IP addresses?
One way is to use the API to execute an AQL search to get the events in the offense, then look at the destination addresses in the events.
If you really mean "remote", then you can use the API to fetch the remove vs local info and use that.
#QRadar#Support#SupportMigration