Custom alert on 1GB outbound traffic

Hi everyone,

I am having trouble creating a custom alert for a host sending a large amount (over 1GB) of traffic externally. I can create a log query showing top assets with outbound traffic but could not find a way to create a trigger that would filter on aggregate functions. Something similar to HAVING clause in SQL.
Any ideas?

Hi @dejan_bojic,

AFAIK it is not possible yet as you can’t then check all entries of the groupby.
There is already a feature request for that. You should create a support case so you can be attached to the ticket.

Sneak Peak: There is an upcoming early access for a new “Anomalous Data Transfer” feature.
That could be interesting for you. Please contact your CSM for that.

Great, thanks for the help and the info Philipp!