topic Forwarding IPFIX flows from flow sensor to Third-Party device in Security Analytics

Forwarding IPFIX flows from flow sensor to Third-Party device

auhae — Wed, 22 Jan 2020 06:05:54 GMT

Does Cisco Stealthwatch Flowsensor support forwarding IPFIX flows to Third-Party flow analytics tool?

If it is possible, then where can I get Stealthwatch IPFIX "Private Enterprise Element Definition" to decode flows on the recipient end.

I was successful in forwarding the flows to another analytic tool by adding additional entry in "Advanced Configuration Menu" in Flowsensor configuration. But was unable to decode the flows.

Re: Forwarding IPFIX flows from flow sensor to Third-Party device

kyoshiik — Thu, 23 Jan 2020 12:11:30 GMT

FlowSensor is custom IPFIX format and 3rd party flow analytics tools can't handle it.

So, if you need Flow data from Flow Sensor, you can export them from Flow Collector.

We have API for flow exporting from Flow Collector. Please check below link:

https://github.com/CiscoDevNet/stealthwatch-data-exporter/blob/master/src/main/java/stealthwatch/flowforwarder/client/FlowForwarderClient.java