Total number of intrusions blocked/total

1 reply
2736 views

Hello!

Is there any way to easy see the total number of intrusions blocked vs the detected total?

Right now, without any breakdown we have the and the Intrusions Detected/By Types & Intrusions Blocked. The problem is that we manually have to add the Blocked up to the total in the Detected section per Intrusion. Just to make sure it´s 100% blocked vs detedted. Or we have to look @the Intrusions Monitored section to see if that is empty.

hzhao_FTNT

Staff

Hi there, you can create a pie chart based on below query:

log type: attack

select (case when (nullifna(attack) is not null and action in ('deny', 'blocked', 'reset', 'dropped')) then 'Blocked' when nullifna(attack) is not null then 'Detected' else 'Others' end) as status, count(*) as total_num from $log where $filter and nullifna(attack) is not null group by status

regards,

hz

Sign up

Login with SSO

Login to the community

Login with SSO