Hi,
I am currently trying to create a search that looks at NetFlow data from all our hosts using a specified port 389
The value(traffic) is not fixed as some of our hosts have a normal hight chattiness using LDAP.
So my problem is that I haven't figured out how to create a search that's able to find the spikes in traffic.
What i do is trying to count packets, and say if the volume is doubled within the timewindow of 10 minutes, create an alert for that one host(src_ip)
Any tips or tricks?
I did try creating a search using moving average but the visual representation was all mumbled using timechart.
