Perspectives

This part of the configuration can be found in Settings → Processing → Perspectives.

The Flowmon ADS module allows you to create your own event perspectives that assign priorities to events. This operation is performed based on the type of event, the network segment where the event occurred (based on the filter), and on the data feed, which provides the flow data used for event detection. Perspectives can be used for reporting events, alerting, or searching in the application GUI. Each perspective is a uniquely named group of priorities assigned to events of a given type (that is, to events generated by the given detection method). The assignment can be either network-wide or dependent on the filter.

You can create or edit the perspective using the simple or the advanced form. The simple form allows you to manage basic settings, such as choosing the filter and data feed, and distributing the methods to the chosen priorities. The filter is assigned to each priority twice – once as a source filter and once as a target filter. The method can only be assigned to one priority.

The Flowmon ADS module offers five event priorities:

• CRITICAL

• HIGH

• MEDIUM

• LOW

• INFORMATIONAL

The advanced form allows you to further specify the settings. You can assign a specific filter and data feed to each method separately. You can choose the filter to be a source and/or target one for each method. It is also possible to assign priority to individual submethods and instances of the chosen method (for example, to prioritize dictionary attacks to RDP protocol over dictionary attacks to the Samba server). The advanced form allows you to create conflicting rules with a non-empty intersection. In this case, the event is set to the highest possible priority. You can also call the function of assigning the INFORMATIONAL priority to the remaining items. It is possible to switch to the simple form only when the set of rules of the advanced form corresponds to the rules of the simple form.

The predefined perspectives can be generated using the Create default perspectives button.