Top-Talker in location

Hi all,

is it possible to filter for the top-talker client ip in one specific location?
I tried it with all possible Insights but i didn´t find one that fits my need.

I just need to find the client ip which sends the most traffic in an location.

Do anyone have a solution for this?

I think this works.
Make a copy of the User Activity -> Which users browse the Web the most? Interactive Report.
Edit the Top User widget and add a Location filter at the bottom.

This should give you a list of the Top Talker for that specific Location.

2 Likes

You can use almost the same process for the Firewall Activity as well using the Firewall Traffic Overview template. Just change the Location filter at the top to User and add a Location filter at the bottom.

1 Like

Thanks Gordon, but I need the client IP of the Top Talker. With your solution i can only see the user name, which is obfuscated due to data privacy. I work in Germany, so this is a big topic here.

And by the way the user name wouldn´t help because in that specific location, there are only servers which use the no-auth port of Zscaler.
Do you have any other ideas?

I can’t work out a way to do this via Insights. The limiting factor being the Client Source IP is not available as a filter.

The only option I can think of is via a log export either manually or via the NSS to your SIEM.

1 Like

Thanks Gordon.
Than we have to do it like this.

I just had hope that there is an faster way than this one.

Not sure if i got the question right but (if you have the advanced FW licence) this should give you the infos you need.

Analytics->Firewall Insights->Client Source IP
Chart Type: Table
Units: Bytes
Filters:
a) Location: the location you want to see
b) Outbound Bytes: All Sizes

Hope that helps.

2 Likes

The Client Source IP filter is the one on the display page on the right not the one at the bottom under Select Filters.