Features and Capabilities

The ADS module is part of the Flowmon solution and is easy to install on a Flowmon appliance. It offers the following functions and features:

• Supports NetFlow v5/v9, for IPFIX and for IPv4 and IPv6

• Implementation of the bidirectional flow standard (RFC 5103)

• Building of long-term behavioral profiles of devices in the network in terms of provided and used services, traffic volumes, and communication partners

• Predefined set of rules for detection of undesirable behavior patterns – operational issues, attacks, unwanted services

• The environment for analysis with a direct indication of problems in the network (the Analysis section)

• Complex filtering options and event prioritization linked to reporting and alerts

• Integration of tools for obtaining additional information (DNS, Application, WHOIS)

• Support for adding custom information about IP addresses (name, role, username, . . . )

• Automated outputs through email, Syslog, SNMP, or custom scripts

• Remote traffic capture triggered by generated events

• Central user interface to use and manage more Flowmon ADS instances from a single point

• Ability to browse IDS events from the IDS Collector module (if installed)

• Predefined set of rules for detecting network anomalies such as behavior change of devices on the network, discovering new network services, and so on

• Interactive visualization of events and relevant context in the form of directed graphs

• Integration with the MITRE ATT&CK framework