Am trying to create a list of the top 10 blocked IP addresses on an external interface over the last month. Am trying to use nDepth and a saved search of TCPTrafficAudit events.
SourceMachine field is displayed in the events but doesn't appear in the Refine Fields display or within the Data Configuration section of the graph tools.
This field name is visible with the Monitor and can be graphed there but I can't figure out how to do the same in nDepth.
Any suggestions would be appreciated.