Creating a dataset containing attack name instead of attack ID

Chapter 13 Logging and Reporting : Advanced logging : Creating a dataset containing attack name instead of attack ID

If you want to create a dataset that contains the attack name instead of the attack ID, use the following as a basis.

config report dataset

edit top_attacks_1hr

set log-type attack

set time-period last-n-hours

set period-last-n 1

set query “SELECT attack_id, COUNT( * ) AS totalnum FROM $log WHERE $filter and attack_id IS NOT NULL GROUP BY attack_id ORDER BY totalnum DESC LIMIT 10”

end