1 Reply Latest reply on Aug 19, 2015 5:15 AM by darragh.delaney

    NTA Top 100 Report

    kentk94

      I'm trying to customize a Top 100 Report for NTA and am having some difficulty with modifying the report.

       

      Our Security analyst is looking to find the top traffic flows to and from a specific Network Node.   I'm trying to modify the results of the "Top 100" report to show this.

       

      I'm modifying the Conversations DataSource with the following:

       

      I want to report on "Netflow Flow by Conversation History"

           Where - At lease one child condition must be satisfied (OR)

                Destination Hostname     contains     (Part of the server name)

                Source Hostname           contains     (Part of the server name)

       

       

      The report never runs.  I've tried changing the variables to IP, Name...nothing nets me results.  If I leave it as default, I get results, but not the ones I need.

       

      Any help is much appreciated.  Unfortunately I'm not very strong with SQL Queries.

       

      Thanks!