1 Reply Latest reply on Feb 22, 2016 4:55 PM by ice

    Alert on hostnames in Top XX Receivers\Transmitters


      Greetings All,


      So I was able to detect some anomalous network traffic using NTA today.


      A PC was the receiver of an unusually large amount of data.


      It showed up on my Top XX Conversations as well as my Top XX receivers


      Top 50 conversations.jpg


      Top XX Receivers.JPG


      All my PC's have the same naming convention. Hostname starts with PPWKS.


      Is there a way to configure an alert that can trigger when a top transmitter or receiver is a PC? i.e. match the hostname?


      I am not sure if I can alert on hostnames


      I can start with the built-in report "High Receive Percent Utilization with Top Talkers" which allows alerting based on a % of the Interface, but this isn't exactly what I want.


      Do I need custom SQL?