A host that keeps connecting
Regular outbound traffic is normal for a lot of software. Record the pattern before you name it malware.
Four fields, then a conclusion
Write the host, the destination, the protocol and port, and the interval. "It beacons" is a conclusion. "Every minute it opens a connection to one name" is a note someone else can check.
If you have both a name and an address, keep both. They answer different questions, and one of them may be the only stable one tomorrow.
What else connects on a schedule
Updates, telemetry, license checks, and mail clients all connect on a timer. Compare the destination with the software you expect on that machine, and with the same host yesterday.
A new destination is a different finding from a known updater that got louder. Say which one you have. The difference is the whole decision.
What a capture still shows
If the traffic is encrypted, the payload is not sitting in the clear for you to read. You can still see timing, sizes, the name in the handshake, and which side started the connection.
The Wireshark workbench stays on that kind of reading. The packet lab puts one ordinary page load in order, so the sequence is familiar before you judge a long capture. You are not sending traffic from either page.
Judge the timing you measured
One Wireshark case is a regular connection judged from the gaps between packets. Use it to practice saying what you measured, including the ordinary software that would look the same.
A detection rule comes after that sentence. If you cannot name the false positive, you do not have a pattern yet. You have a worry.