Hi,
Fairly simple setup overall:
- There is a Traffic Profile with traffic pattern and deviations gathered over time from the DNS sever - graph/data can be seen;
- Correlation Rule is created for that Traffic Profile. Again - nothing fancy - looking for traffic profile change and checking if the number of connections are greater than 1 deviation;
- Correlation Policy is created and that specific Rule is assigned to the policy.
Result: even if traffic goes above that deviation - no Correlation Events are generated. I've tried using absolute byte values, using velocity data, using bytes/connections, etc. in the Correlation Rule - could not get it to raise an event. Other Correlation Rules are working fine - ones that are not using the Traffic Profile, so my guess is that there is a problem with that specific feature.
I was able to reproduce it in two different environment + dCloud demo cloud.
Is anyone out there using Traffic Profiles in Correlation Rules and have positive results or have stumbled upon something similar?
Thanks!
