Detection Methods

Detection methods can be configured in Settings → Processing → Methods.

Detection methods are predefined by the manufacturer and used to detect various potentially undesirable activities on the network. The various methods are described in detail in the Detection methods chapter.

Above the table, there is a search field that supports full-text search.

The configuration consists of:

• activation and deactivation of a method

• assignment of filters to methods (any number of filters can be assigned)

• specific configuration (methods may have specific configuration parameters that can be set or actions that can be performed)

Depending on the nature of the method, some of the options above can be inactive. The system methods for example, (for example, event reporting) cannot be turned off nor have filters assigned. All configuration changes will take effect immediately after processing the next batch of flow data by the respective method.