Differences

This shows you the differences between two versions of the page.

--- offline:wrccdc_pcaps_results [2018/05/12 23:48] – [Retro Analysis - view advanced counters] veera
+++ offline:wrccdc_pcaps_results [2018/05/12 23:52] – [Explore flows] veera
@@ Line 71: / Line 71: @@
 ===== Drilldown techniques =====
+Once you have a fairly solid baseline you can go back and decide which paths you want to follow to drilldown further. You might be interested in first checking out the critical IDS alerts, or tracking down flows. This section introduces you to the tools you will use for the drilldowns.
 ==== Explore flows ====
+Most of the times you want to first drop down to the flow level. This can be accessed by "Explore Flows" or by clicking on the menu items within the context of whatever you are doing. Most of the screens such as alerts, metrics, etc  have a "Explore Flows" option.  TrisulNSM stores all flows and reports with blazing speed, even when there are hundreds of millions of them.
 [{{ :offline:w23-scan.png?400 |Jump to flows , query flows}}]