Alerting on individual host download thresholds

Hi all,

Firstly, thanks to the support team for identifying and fixing my earlier issue with unusual sent/received statistics.

Im now wondering if it is possible to produce an alert that would identify individual hosts that have downloaded more than say 1GB per day. I realise it is possible to create an anomoly alert filtered by a network address but the alert created is triggered when the threshold is reached for the entire subnet. Not exactly what I expected but I guess it makes sense.

What I would like to do is have an alert trigger if a particular host downloads more than a certain amount within a 24 hour period. Assume that I dont want to put in a seperate alert for every IP address on the network.

I would appreciate any assistance you can provide.

Regards,
Luke