Feature request: Alert for a same source user
Currently, when we configure an alert in ADAP, we have the option to configure 'Threshold based alerts'. That way we can set a number of events within a given time period so that the alert is triggered.
It would be useful if you had the option 'from the same source user'.
In this way, we could generate an alert if the same user made changes to several files in a short period of time, for example (in this way we would even know if it was a ransomware attack).
It would be useful if you had the option 'from the same source user'.
In this way, we could generate an alert if the same user made changes to several files in a short period of time, for example (in this way we would even know if it was a ransomware attack).