does anyone know a way read out the current connections in one hour or one day?
At the latest version (8.3.2P07) you can use the 'cf usage' command. Do a 'man cf_usage' to read about it; a 'cf usage h' will show you the "quick help" screen for that command.
cf usage show [type=<usage_type>] [<days|hours>=<period>]
$> cf usage show type=traffic_by_network-applications days=4
$> cf usage show type=gti_by_source-ips hours=2
Here are the reports it can show (type=something_below):
executable malicious-executable traffic_by_ips-events
gti_by_network-applications gti_by_users gti_by_source-countries
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center