Firepower Management Center Top Hosts consuming Bandwidth

[Nick Currie]

HI there. I was wondering if there have been any improvements made to the reporting for the FMC. We are currently running 6.2.3.1 and i would love to be able to create a report that orders top X hosts by bandwidth consumed. Can anyone point me in the right direction?

[evan.chadwick1]

if your concerned about large data users, maybe a correlation rule that tracks bytes received by host over say 1Gb and then receive alerts is another option?

Have you run some of the inbuilt reports, like the network one, it might have a top talkers?

Tried creating your own report ?

[Nick Currie]

An alert is not really what im after. I cant see what I need in the inbuilt reports. Yes, I have given the report creating a bash - I have tried creating something using the count field - but im not 100% on it..

Its a connection event table with the following fields

Client (Not sorted), Traffic KB (Sorted largest first), Count (not sorted), Initiator IP (not sorted)

[evan.chadwick1]

I think you can create a report from Correlation events? I'll take a look next week.

[balaji.bandi]

Have you tried FMC - analysis - Customer Analysis - add widgets 

I have done one for VPN Clients,(not tested your requirement, when i get chance test and let you know)

http://www.balajibandi.com/2019/07/08/fmc-untold-dashboard-widgets/