topic Re: Cisco security network analytics change core events in Security Analytics https://community.cisco.com/t5/security-analytics/cisco-security-network-analytics-change-core-events/m-p/4969871#M1014 <P>Hi <a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1330179">@dijix1990</a> - the key thing here is that bandwidth consumption is always an average over some time-period.&nbsp;&nbsp; So in the High Traffic alarm you're looking at the average over a 5-minute processing period.&nbsp; It will not alarm if the host simply hits that peak.&nbsp; Does that help?</P> Fri, 01 Dec 2023 14:52:33 GMT jamegill 2023-12-01T14:52:33Z Cisco security network analytics change core events https://community.cisco.com/t5/security-analytics/cisco-security-network-analytics-change-core-events/m-p/4935347#M991 <P>Hi, I need an advice. I want to be allarmed when one host eirher consume bandwith above 30 Mbps, I made&nbsp; new policy in the "Core events" - single host policy but it seems doesn't work</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="dijix1990_0-1696586186312.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/198979iBF4754B5C2626705/image-size/medium?v=v2&amp;px=400" role="button" title="dijix1990_0-1696586186312.png" alt="dijix1990_0-1696586186312.png" /></span></P><P>&nbsp;</P><P>What am I doing wrong?</P> Fri, 06 Oct 2023 10:00:11 GMT https://community.cisco.com/t5/security-analytics/cisco-security-network-analytics-change-core-events/m-p/4935347#M991 dijix1990 2023-10-06T10:00:11Z Re: Cisco security network analytics change core events https://community.cisco.com/t5/security-analytics/cisco-security-network-analytics-change-core-events/m-p/4969871#M1014 <P>Hi <a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1330179">@dijix1990</a> - the key thing here is that bandwidth consumption is always an average over some time-period.&nbsp;&nbsp; So in the High Traffic alarm you're looking at the average over a 5-minute processing period.&nbsp; It will not alarm if the host simply hits that peak.&nbsp; Does that help?</P> Fri, 01 Dec 2023 14:52:33 GMT https://community.cisco.com/t5/security-analytics/cisco-security-network-analytics-change-core-events/m-p/4969871#M1014 jamegill 2023-12-01T14:52:33Z