Alert for domain's visited

This depends on what modules you are running.  If you are running NTA, then it's one way, if you are running NPM or LM and sending firewall logs to Orion, then it's another way.  What are we working with here?

Thanks for the quick response.  Currently have NPM and NTA.  I have NTA displaying top domains but I want to have it alert me if a certain domain is being accessed.

For this, I'd have to tap jreves​ and his team.  I know the data exists in SWQL, but I don't have the information at hand.

We don't have this specific alert in NTA, but it's an interesting use case. For alerts in NTA, we need a particular context - in this case, a node or interface reporting flow traffic. So - I'm thinking that an alert for a domain being accessed would reference a particular context, a source endpoint or IP group accessing the domain, and then the domain or domains being accessed.  Does that sound right?

joer

Yeah you nailed it.  I want to set up an alert when a certain IP group access a certain domain.  Is this something that could be done?