I have a question about SIEM EPS counting.
When I check siem interface eps counting everyday, there are little bit different range that I see.For example, today 10000 EPS, yesterday were 5000 EPS. That's the huge difference.It could be acceptable 1000 EPS. But 5000 EPS is not.
May be theresholds are helpful.
How can I create an alarm when it happens?Therefore I can see differences.