SIEM & UEBA

  • 1.  Total Interface Down time

    Posted 15 days ago
    You can pull events showing when an interface goes down and when it come backup, However there does not appear to be a way to total the time between the two events.  Is there a way to do this.   One way I have though about, is to setup a rule that create an event that will store the difference between the Down and Up events., rather than an incident, but I haven't found a way to do that