Dear community,
I am trying to generate some reports where I pick out a source or destination IP when a certain event count threshold is met
For example
all source IP addresses greater than 1000 Total Event count .
While I see more than one way to display this data, i can't find a way to create a report, or a view to display this data with the filter in mind.
Does any one have any clue if this is even possible?
Thanks
Solved! Go to Solution.
Have you considered creating correlation rules for the thresholds and reporting on those events when they fire?
Have you considered creating correlation rules for the thresholds and reporting on those events when they fire?
I did but I am trying to avoid creating unnecessary correlation hits.
It's also not quite what I am looking for.
Good Idea though. I might just have to consider doing that in historical mode.
Andy,
I figured that out in the last a few days ago.
Been meaning to reply.
Thanks,
How did you managed to filter based on event count?
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA