When the flow is first put to use it was mainly for simply gaining visibility into application bandwidth
usage between IP addresses.
Now it is rapidly rising as an integral part of security monitoring products like stealth Watch use
not flow data to create a full picture of a network with drill down Security Analysis features.
Heres a stealth watch dashboard stealth watch as a lane cope a product which has been purchased by Cisco.
It works by simply signing now flow data from all of your network devices to a stealth watch collector
and it has the ability to correlate information and gives you context for IPS users and activity on
the network.
You can see on the top of the dashboard it has a nice summary of the different attacks that exist on
your network.
The flow collection trend at the bottom of the dashboard can be helpful to see if there is anomalies
on the network.
So if Normally I'm peeking my flow is around 700 and that all of a sudden I have a day of 900 closes
on that to me would be a traffic anomaly and I would want to drill into what users and IPs were creating
all these extra flows.
Now take a look at how you can drill down into attacks that have happened on your network or go to the
Network tab and then host on the right side we have a nice list of hosts on our network sorted by overall
civility.
So looks like this top post here has had the most policy violations.
So that might be a host that I want to dig into to see what kind of activity they've had on our if we
look at the alarm section here there is a list of how many events have occurred for each type of attack.
I'm going to click on it.
Exfiltration and we'll drill down into this attack and try to see what IP address and user triggered
this alarm.
So it looks like we have one host that has had traffic that's matched exfiltration and it looks like
the host is part of our compliant systems group are going to click on the host address
Well this is interesting.
I can see that that host is sending data to China and the alarms that's been triggering is suspect data
loss and data exfiltration.
If I scroll down I can even see what user account is being used for these exfiltration items.
So just by analyzing that flow data stopwatches been able to tie all these pieces together for me.
And now I know that I need to remove this host and possibly user from the network.