RSA Admin

Rule to monitor baseline changes

Discussion created by RSA Admin Employee on Oct 28, 2010


i was hoping to be able to be alerted if a device group event count was to increase by a percentage above a daily baseline.  in other words to alert if there was a spike in the number of events that were being sent by a device group - i could then investigate which single device was potentially having a problem.  Please reply if you feel that this is not worth while or if there is an easier way to do this.