The current netflow allows for aggregates, but not the ability to do searches and return full flow details. If you want to know all the traffic that went from host a to be, and see the ports, volume of data xfered, on a tcp session the reason for teardown etc. you need full details. Today we get this data by capturing full session logs from firewalls which is not efficient.
The ability to apply data maps to those netflow sessions, so if you have a watch list you can trigger actions based on flow data.
by: cameron s. | over a year ago | Integrations
Comments
yes, the requested feature is a *must* for any modern SIEM product. My customers also highlighted the same multiple times.
I'm also running into this "lack of full netflow support" problem quite often with customers. Full Netflow support is a basic and key feature in SIEM products nowadays.