Proxywatch feature in Stealthwatch

[mshboul89]

As i understand, Proxywatch feature should correlate the external proxied IP/port with the real client IP/port, so that we get to know the real user IP that corresponds to a specific proxied access as seen from outside the proxy.

I am using WSA with Stealthwatch in my case, where WSA sends proxy logs in W3C format to FC.

The question is:

How does stealthwatch correlate the external and internal proxy connections ? Based on which fields ?

Thanks in advance.

[hanjabbo]

For the proxy watch feature to work properly you have to have flow from before the proxy and from after the proxy in addition to the proxy logs . the correlation happens using the timestamps, source ip /port, destination ip / port. from flows before and after in addition to the logs