Flowmon App - Events

In the Events view, you can inspect individual security events. You can classify events into perspectives (an event can belong to zero or multiple perspectives). You can also specify event priority.

Each event has a unique ID and timestamp displayed in the Time column. The Type column indicates the detection method type. The Detail column provides more specific information about the event. The Source and Targets columns display the IP addresses involved in the event. Data feeds indicate the flow data source.

Perspectives and Data feeds are configured in the Flowmon Solution. Refer to the Flowmon ADS User Guide for details.

To list events not assigned to any perspective, select the "-" option in the Perspective drop-down menu in the filter. This helps you verify that events requiring classification are assigned to appropriate perspectives. You can also check whether events are classified to the correct perspective when sent through syslog to QRadar.