I'm trying to customize a Top 100 Report for NTA and am having some difficulty with modifying the report.
Our Security analyst is looking to find the top traffic flows to and from a specific Network Node. I'm trying to modify the results of the "Top 100" report to show this.
I'm modifying the Conversations DataSource with the following:
I want to report on "Netflow Flow by Conversation History"
Where - At lease one child condition must be satisfied (OR)
Destination Hostname contains (Part of the server name)
Source Hostname contains (Part of the server name)
The report never runs. I've tried changing the variables to IP, Name...nothing nets me results. If I leave it as default, I get results, but not the ones I need.
Any help is much appreciated. Unfortunately I'm not very strong with SQL Queries.
Thanks!
