End User Traffic represents sum of the traffic from all IP addresses he used during a certain time window. 

When atypical behavior or a threat in the network is investigated, information about IP address often does not provide precise identification of the responsible person. Administrators are now able to determine exactly who used the IP address at the specific time by linking an address to a username. This significantly improves situational awareness and reduces incident response/time to resolve - help desk agent can quickly react and cross-check suspicious behavior.

In order to view End User Traffic, you first need to configure collecting logon messages in order to map users with their IP addresses. When properly configured, end users will automatically appear in the node tree as they logon to their workstations and start making traffic. To learn more go to Setting End User Traffic.

End User Traffic is visible only to users with Write permission on the NetFlow module.

End Users Traffic shows top talkers for: