Greetings All,
So I was able to detect some anomalous network traffic using NTA today.
A PC was the receiver of an unusually large amount of data.
It showed up on my Top XX Conversations as well as my Top XX receivers
All my PC's have the same naming convention. Hostname starts with PPWKS.
Is there a way to configure an alert that can trigger when a top transmitter or receiver is a PC? i.e. match the hostname?
I am not sure if I can alert on hostnames
I can start with the built-in report "High Receive Percent Utilization with Top Talkers" which allows alerting based on a % of the Interface, but this isn't exactly what I want.
Do I need custom SQL?
