So I was able to detect some anomalous network traffic using NTA today.
A PC was the receiver of an unusually large amount of data.
It showed up on my Top XX Conversations as well as my Top XX receivers
All my PC's have the same naming convention. Hostname starts with PPWKS.
Is there a way to configure an alert that can trigger when a top transmitter or receiver is a PC? i.e. match the hostname?
I am not sure if I can alert on hostnames
I can start with the built-in report "High Receive Percent Utilization with Top Talkers" which allows alerting based on a % of the Interface, but this isn't exactly what I want.
Do I need custom SQL?
This is not a feature at the moment. NTA has 2 alerts only.
1. Interface utilization alert with Top talkers
2. CBQoS alerts.
But NTA does not have the alert - to trigger when an endpoint generated this amount of ingress or egress data.