We would want it to notify or put in a chart the IP address and how many times it was blocked. We are currently using FireGen with the Kiwi Syslog monitor and that sends the reports but we would like to add it to the dashboard of LEM or NPM.
Just create a LEM Filter on CoreNetworkTraffic event group (which should cover TCPTrafficAudit, UDPTrafficAudit, etc) and a keyword match on Deny. You can then add a custom widget to the OPS CENTER dashboard, and trend that filter.
