Trisul Traffic Meters (Counter Group Index)
Every counter group Trisul ships with out of the box is documented on its own page. Each page includes its GUID, bucket sizes, special keys, and the full meter table with descriptions.
Use Customize → Counters → View Meters in the product to see live values for any of these.
All counter groups (64)
| Group | What it measures |
|---|---|
| Aggregates | This group reports aggregate totals such as overall bandwidth and packet rate seen across the whole network. |
| Alert Classes | This group classifies IDS alerts into broad alert classes and counts alerts per class per five-minute interval. |
| Alert Priorities | This group classifies IDS alerts by priority level and counts alerts recorded at each priority per interval. |
| Alert Signatures | This group tracks IDS alerts by individual signature and counts alerts per specific signature per interval. |
| App-ID | This group measures traffic classified by App-ID as exported by devices such as Palo Alto firewalls. |
| Apps | This group measures application-wise traffic bandwidth along with the security alerts associated with each application. |
| ASNumber | This group measures external inbound and outbound bandwidth broken down by Autonomous System Number. |
| Base Domains | This group measures traffic by base domain and explicitly excludes traffic served through a CDN. |
| BGP-ASPATH | This group measures inbound and outbound bandwidth for traffic routed along specific BGP AS paths. |
| BGP-Origin AS | This group measures traffic bandwidth destined for or originating from a given BGP origin autonomous system. |
| BGP-Peer AS | This group measures traffic bandwidth exchanged with a specific BGP peer autonomous system. |
| BGP-Prefix External | This group measures inbound and outbound bandwidth for traffic to and from external BGP prefixes. |
| Blacklist | This group tracks matches and connections involving domains, URLs, or IPs on a blacklist. |
| City | This group measures external inbound and outbound traffic broken down by originating or destination city. |
| Country | This group measures external inbound and outbound traffic broken down by country. |
| Dir Mac | This group measures directional traffic exchanged between a specific pair of MAC addresses. |
| Email Hosts | This group measures per-host network metrics and bandwidth for hosts exchanging email traffic (SMTP, IMAP, POP3). |
| External Hosts | This group measures per-IP-host network statistics for IPv4 hosts outside the home network. |
| External Hosts v6 | This group measures per-IP-host network statistics for IPv6 hosts outside the home network. |
| Flow-APPID-NBAR | This group measures bandwidth and alerts for applications identified through NetFlow NBAR classification. |
| Flow-ASN | This group measures NetFlow-derived bandwidth exchanged with a given autonomous system, including its upstream or downstream role. |
| Flow-BGP-NextHop | This group measures traffic bandwidth routed via a given BGP next-hop address, as reported by NetFlow. |
| Flow-IP-NextHop | This group measures traffic bandwidth routed via a given IP next-hop address, as reported by NetFlow. |
| Flow-Link-ASN | This group measures NetFlow bandwidth to and from an autonomous system on a specific network link. |
| Flow-Prefix-v6 | This group measures traffic bandwidth by IPv6 prefix as learned from the router's RIB. |
| Flow-Prefix | This group measures traffic bandwidth by IP prefix as learned from the router's RIB through NetFlow. |
| Flow-TOS | This group measures traffic bandwidth carrying a given Type of Service value in the IP header. |
| Flow-VRF | This group measures traffic bandwidth classified under a given VRF (Virtual Routing and Forwarding) instance. |
| Flow Gens | This group measures the total bandwidth of flow, template, and log records received from a given flow generator. |
| FlowIntfs | This group measures combined received and transmitted bandwidth and flow metrics per network interface, based on NetFlow. |
| Hosts | This group measures per-IP-host network statistics, including bandwidth, connections, and security alerts. |
| HostsIPv6 | This group measures per-IPv6-host network statistics, analogous to the IPv4 Hosts group. |
| HTTP Content Types | This group measures HTTP traffic bandwidth broken down by content type. |
| HTTP Hosts | This group measures HTTP traffic bandwidth broken down by HTTP Host header value. |
| HTTP Methods | This group counts HTTP requests observed for each HTTP method, such as GET or POST. |
| HTTP Status Codes | This group counts HTTP responses observed for each HTTP status code. |
| ICMP Types | This group measures traffic bandwidth broken down by ICMP message type. |
| Internal Hosts | This group measures per-IP-host network statistics for IPv4 hosts within the configured home network. |
| Internal Hosts v6 | This group measures per-IP-host network statistics for IPv6 hosts within the configured home network. |
| LinkLayerStats | This group breaks down link-layer Ethernet frame bandwidth by EtherType protocol, including IPv4, IPv6, ARP, VLAN, and MPLS. |
| Long Fat Tail Hosts | This group measures bandwidth for hosts characterized as long fat tail web traffic generators. |
| Long Thin Tail Hosts | This group measures traffic bandwidth for hosts falling outside the top one million global popularity lists. |
| Mac | This group measures traffic bandwidth per Ethernet MAC address. |
| Meta Counter Group | This group reports internal statistics about the counter engine itself, such as cache sizes and database flush times. |
| Meta Session Group | This group reports flow-session activity metrics, such as flow cache size and the number of new flows established. |
| MITRE Subtechnique | This group counts security detections mapped to specific MITRE ATT&CK subtechniques. |
| MITRE Tactic | This group counts security detections mapped to specific MITRE ATT&CK tactics. |
| MITRE Technique | This group counts security detections mapped to specific MITRE ATT&CK techniques. |
| MPLSStats | This group monitors traffic bandwidth associated with individual MPLS labels. |
| NetworkLayerStats | This group breaks down network-layer activity by IP protocol field, reporting bandwidth and active flows per protocol. |
| Organization | This group measures traffic bandwidth and alerts per remote-office organizational unit. |
| Perf-Stats | This group monitors internal Trisul probe and hub performance, resource usage, and processing health. |
| Prefix | This group measures external inbound and outbound traffic broken down by IP prefix. |
| Remote Office | This group measures bandwidth and alerts per remote office branch. |
| SNMP-Interface | This group measures interface bandwidth and utilization derived from SNMP polling of network interfaces. |
| SSH Hosts | This group measures per-host network metrics and bandwidth for hosts communicating via SSH. |
| TLS CAs | This group tracks TLS handshakes by the certificate authority appearing in the certificate chain. |
| TLS Ciphers | This group measures traffic bandwidth by negotiated SSL/TLS cipher. |
| TLS Orgs | This group measures traffic bandwidth by the certificate organization identity in TLS connections. |
| Unleash Apps | This group demonstrates rule-based counter grouping to track and measure custom enterprise application traffic. |
| Unusual Traffic Hosts | This group tracks hosts exhibiting abnormal or anomalous communication patterns and bandwidth usage. |
| User ID | This group measures traffic bandwidth and flow counts attributed to a specific User-ID, as exported by devices such as Palo Alto. |
| VLANStats | This group monitors traffic activity segmented by VLAN, reporting per-VLAN bandwidth in both directions. |
| Web Hosts | This group measures per-host network metrics for hosts communicating over HTTP and HTTPS protocols. |