morning, I have a question and problem, I made a query to bring powershell events through the powershell_events table:
I created a pack with this query
select * from powershell events
But when I did it started to get a flood of events and the traffic went up from 150MB to 1GB I realized after 5 min later ....
When I realized I stopped the pack, even excludes it but still this event keeps coming
is there anything to be done so that the hosts stop sending or just wait to normalize?
This pack was run for 2500 hosts