In this lecture I will continue explaining how to work with Ilsa using more options but clearly displaying
the summary statistics using the GROUP BY clause or cured.
So here in Asia we see the field summary about the results that we have gotten where we have for example
1 program 1 class 9 source IP addresses 85 source sports and so on.
And if we want to display the 9 source this is that our present in these records.
I will click here and we see that a new tab appeared with 57 IP addresses with the number of records
for each source IP and you might ask but we should have nine source IP addresses not fifty seven and
the answer to this question is that the nine source I read this is out for the first 100 records while
the fifty seven source IP addresses are for the whole 1000 plus records and to be sure of that I will
go to the first tab and then insert the or change the limit for the number of the records to be fifteen
hundred.
And then I will hit on into and we see that a new tab appeared with the source.
I have addresses to be fifty seven
and also in the first tab we see that when we clicked on the source IP link that in the second tab
the query field was related automatically with the group by keyword based on the source IP address.
So this is another way for displaying the summary statistics by using the group by keyword in the query
field also.
There is a third way to displaying these.
Somebody said 6 which is by using the report on a drop down menu.
So here if I go to the first tab and then select report on and then put a connection and then source
IP we see that the group by cured.
Based on broken it open source IP was added to the query field and then I will hit head on enter and
we see that a new tab pose appeared with the same results as the previous tab and also we have another
or fourth way or final way for displaying the somebody's statistics which is by using the connections
or janitors top link.
And to do that I will close all the opened taps and then I will click on this link here.
So the connections top originators link and I will click.
Now how do we see that we do not have any results because when we do that the data just changes back
to be the data for the last two days.
So I have to click on this from and then select the date to be this date.
And also I will again change the limit to be fifteen hundred and I will hit on interrogation and we
see that we have the same results based on the source Heidi.
So also we see that somebody you summarize that sticks displayed the number of records for HIV starting
with the most active one or the I.V. that has the highest number of records.
So the most active one and we can rearrange the order by clicking here on the account
and also by arranging the IP addresses based on the number of records.
So starting with the most active one we can focus our analysis on the traffic that is more suspicious
in order to eliminate the false positives as much as we can.
So in this lecture I have explained how to work with the group by clause or cured in Ilsa and in the
next lecture I will explain how to filter the results more based on a specific value.