Subject: [Dots] per target or aggregated ? RE: DOTS telemetry Issues picked up in Interop Testing

From: <[email-masked]>
Date: Tue, 21 Apr 2020 11:09:37 +0000

Re-,

This is up to the server. The draft says:

   A DOTS server may aggregate pre-or-ongoing-mitigation data (e.g.,
   'top-talkers') for all targets of a domain, or when justified, send
   specific information (e.g., 'top-talkers') per individual targets.

Cheers,
Med

De : Jon Shallow [mailto:[email-masked]]
Envoyé : mardi 21 avril 2020 12:56
À : BOUCADAIR Mohamed TGI/OLN; [email-masked]
Objet : RE: [Dots] DOTS telemetry Issues picked up in Interop Testing

Jon> Which then leads me on to something else.  If we asking for telemetry for 2 (or more) different target IPs and the server is returning vendor specific attack details.  For attack-detail, keyed by attack-id, if the same attack is hitting more than 1 target IP, can I display this information per IP or does it have to be aggregated?