To observe what network services are in use in a network’s activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?
To observe what network services are in use in a network’s activity overall, the Protocol Analysis dashboard in Enterprise Security will contain the most relevant data. The Protocol Analysis dashboard shows the network traffic data by protocol, such as TCP, UDP, ICMP, and others. You can use this dashboard to identify the most active protocols, the most active hosts, the most active ports, and the most active connections in your network. You can also filter the dashboard by protocol, host, port, or connection to narrow down your analysis. The Protocol Analysis dashboard uses the data from the Network Resolution (stream) data model, which requires the Splunk Stream app to collect network packet data1. References =
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit