1 Reply Latest reply on Feb 22, 2016 4:55 PM by ice

    Alert on hostnames in Top XX Receivers\Transmitters

    shawn_b

      Greetings All,

       

      So I was able to detect some anomalous network traffic using NTA today.

       

      A PC was the receiver of an unusually large amount of data.

       

      It showed up on my Top XX Conversations as well as my Top XX receivers

       

      Top 50 conversations.jpg

       

      Top XX Receivers.JPG

       

      All my PC's have the same naming convention. Hostname starts with PPWKS.

       

      Is there a way to configure an alert that can trigger when a top transmitter or receiver is a PC? i.e. match the hostname?

       

      I am not sure if I can alert on hostnames

       

      I can start with the built-in report "High Receive Percent Utilization with Top Talkers" which allows alerting based on a % of the Interface, but this isn't exactly what I want.

       

      Do I need custom SQL?