we have several customers with astaro firewalls, and we want to detect abnormal traffic (for example in time-spaces where normally no traffic occurs, like on weekend).
The asg can use snmp to report the traffic to our splunk.
My idea was to get an average value for the last weeks and trigger an event if a value is over a specific limit or there is a value where no value should be (for example in case of weekend).
If there is an easy way to get this, it would be great. If not, I have to do it my way.