We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
As a defender, I'd like a dashboard specific to NetFlow records:
event.module:netflow | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby network.type | groupby network.transport | groupby network.direction | groupby netflow.type | groupby netflow.exporter.version | groupby observer.ip | groupby source.as.organization.name | groupby source.geo.country_name | groupby destination.as.organization.name | groupby destination.geo.country_name
':netflow:': - soc_timestamp - event.dataset - source.ip - source.port - destination.ip - destination.port - network.type - network.transport - network.direction - netflow.type - netflow.exporter.version - observer.ip
The text was updated successfully, but these errors were encountered:
FEATURE: Add NetFlow dashboard #13009
5b45c80
Merge pull request #13010 from Security-Onion-Solutions/dougburks-pat…
1d16f6b
…ch-1 FEATURE: Add NetFlow dashboard #13009
67645a6
Merge pull request #13011 from Security-Onion-Solutions/dougburks-pat…
27ad84e
Tested and verified:
Sorry, something went wrong.
dougburks
No branches or pull requests
As a defender, I'd like a dashboard specific to NetFlow records:
The text was updated successfully, but these errors were encountered: