Logging Hosts Vs Non Logging Hosts

[vivekramrs]

Hello,

I'm currently exploring the various dashboard options to distinguish between logging hosts and non-logging hosts.

For instance, I'm interested in applying a 7-day filter to the hostname field, comparing it with the results from the last 2 days, and determining which hosts haven't generated any logs in the SIEM. My goal is to set up an alert for such cases.

Would you be able to assist me with this task?

Thank you