ADS Configuration – tune up

The correct settings for flow data sources and filters directly impact detection method results and the overall predictive capability of the module. You can tune up Flowmon ADS detection through several methods:

Filter configuration

Enhance detection by:

• Adding IP ranges/subnets or IP addresses to filters created by the configuration wizard
• Creating new custom filters in Settings > Processing > Filters

False positive management

Improve detection accuracy by creating false positive rules in two ways:

• Mark individual events as false positives, which creates rules that prevent reporting similar events from the same IP address
• Create general false positive rules in Settings > Processing > Data Feeds > False positives to create exceptions for known network traffic patterns such as:
  • Backup operations
  • SNMP monitoring
  • Other regular administrative activities

For more detailed information, consult the user guide or contact us at the Flowmon Support and Learning Hub.