topic Re: Stealthwatch export from sensor? in Security Analytics

Stealthwatch export from sensor?

Scott.ODonnell@gmail.com — Tue, 18 Jul 2017 17:27:22 GMT

All ,

I'm looking to see if it's possible to leverage flow information collected by a stealthwatch sensor in another application.

Based on my research , the stealthwatch sensor will provide flow information including application layer information like URL, etc.

I'm trying to avoid having to place yet another span collector into the environment.

Is it possible to glean this information from Stealthwatch?

If so, what format would it be in?

-Scott

Re: Stealthwatch export from sensor?

brford — Tue, 18 Jul 2017 18:11:15 GMT

Scott,

The current version (6.9) of Stealthwatch Flow Sensor exports data in IPFIX format.

I hope this helps.

Brian

Re: Stealthwatch export from sensor?

Scott.ODonnell@gmail.com — Tue, 18 Jul 2017 18:13:25 GMT

Thanks for the reply Brian.

Is there a sample export or documentation that details the included information?

-Scott

Re: Stealthwatch export from sensor?

jamegill — Tue, 18 Jul 2017 18:20:32 GMT

The Stealthwatch Flow Sensor exports data in IPFIX format (see RFCs 7011, 7012). Any system that can consume IPFIX (or NetFlow or any of the compatible formats) should be able to consume it. Some of the datapoints encoded in the Flow Sensor's data are recorded in "enterprise fields". Those fields which are publicly labeled will use IANA standard IP Flow Information Export (IPFIX) Entities.