The
Count
values represent the minimum
number of events of each traffic type that must occur for the report
to list the associated host with a higher confidence score (higher
likelihood of botnet infection). If the number of events is less
than the
Count
, the report will display a
lower confidence score or (for certain traffic types) won’t display
an entry for the host. For example, if you set the
Count
to
three for
Malware URL visit
, then hosts that
visit three or more known malware URLs will have higher scores than
hosts that visit less than three. For details, see
Interpret Botnet Report Output.