NTA4.4 Top Talkers

That particular alert has been so buggy for me over the years, and I hate leaving my passwords anywhere they can be easily pulled up in plain text like that.

I always completely ditched that way of doing it in favor of just sending a normal email with a link to the netflow page where they can see the top talkers for that interface.

https://YOURSERVER/Orion/TrafficAnalysis/NetflowInterfaceDetails.aspx?NetObject=NI:${N=SwisEntity;M=InterfaceID};T:Last%2024%20Hours;FD:Both

If you really want it to scrape a picture into the email you can just enter the username and password into the box below like so:

But I find that the whole including pictures in the email thing causes me more headaches than it solves.  Been too many problems with it over the years.  If I spent some time thinking about it I could probably just generate a sql query that included the top talkers info as text in a regular email as well, I feel like I've done that for a client once before.

Hi,

In NTA 4.4.0 you will not receive the picture. Just a link and attached PDF in the email. Anyway the username and password are no longer used in the macro. New macro looks like this:

${SQL:SELECT Macro FROM NetFlowAlertMacros WHERE ID='InWebMailInterfaceDetailsLink'}

mesverrum -

I agree about storing passwords. Developers have obviously worked on this a lot over the years. I remember when the username and password appeared in the alert the users received. We began to use DirectLink for that, and then disabled as many rights on DirectLink as possible.

We have mandatory periodic password changes for all accounts, so having to enter and store credentials is a major operational issue in any case. So, I like the fact that the new method no longer requires it. I'm just waiting for it to fire to see the result.

Has anyone done a white paper on securing Orion and its modules?

=Foonly=

stibi -

It's odd that this change was not mentioned in the Release Notes. I think it's an excellent change in theory. I'm now waiting for it to fire to see how it is in execution.

The Administrators Guide is still waiting for the broken section on page 109 to get fixed as of this moment.

=Foonly=

stibi -

I made a typo when entering the macro. It does indeed work! .

The PDF is automatically attached to the email - nothing needs to be done besides entering the recipients, subject, macro, and email server.

For subject, we use:

High RCV Util - Top Talkers - ${Interface.InPercentUtil}% ${N=SwisEntity;M=FullName}

Thanks a lot for your help!

=Foon=

mesverrum -

The new macro results in the same web page as your method, without having to edit the name of the server.

=Foon=