IPS Traffic Increase

You can use this for any type of baselining alerts around a predefined standard deviation. I used the IDS data model but the same logic can be applied to any random index.

You should be able to do something similar on a single sourcetype as such
Share This:

Leave A Comment?