The Big Movers report is a comparison report of attacks occurred in recent time interval with those occurred in a pervious time interval. This is more clear because Recent time interval, and Previous time interval settings can be set in the UI.
You can define the time intervals of the two time periods and get a detailed report of attacks with percentage and direction.
Steps:
Select Analysis → Event Reporting → Traditional Reports.
The IPS Events page is displayed.
Click the Big Movers link.
Select the required fields you need to configure:
Admin Domain — Select the admin domain in which to view alerts.
Note
The admin domain selected in the left pane has no impact on the reports generated. The Admin Domain drop-down list is explicitly to filter the reports that are generated.
Sensor
All Devices is checked by default. This displays information of all devices present at the selected Admin domain. To select your preference of devices, de-select All Sensors and select the devices from the list box.
Include Child Admin Domains — Displays device information for child domains.
Attack Severity — Select one or more from the Informational, Low, Medium, or High severities, which relate to attack impact.
Recent Time Interval and Previous Time Interval — Enter the time period.
Ranking Basis — Select one of the following:
Percentage change in attack count
Change in attack account value
Direction — Select one of the following directions of how alerts occurred should be displayed:
Upward Movers only
Upward and Downward Movers
Downward Movers only
Maximum Movers — Enter the value of maximum occurred alerts to be displayed.
Select the Report Format.
Click Run Report.
The report is displayed with attack details if any.