Powered by Zoomin Software. For more details please contactZoomin

Flowmon User Guide

Table of Contents

IDS Probe Installation and Setup

Save PDF
Save selected topicSave selected topic and subtopicsSave all topics
Share
Share to emailCopy topic URL
Print
  • Last Updated: September 16, 2026
  • 4 minute read
    • Flowmon Products
    • Flowmon
    • Documentation

The Flowmon IDS Probe module integrates the Suricata IDS functionality into the Flowmon platform. This section describes how to install the IDS Probe module and configure the basic setup to enable signature-based detection.

Prerequisites

Before you install the IDS Probe module, confirm that:

  • You have administrative access to the Flowmon Probe.

  • You have SSH access to the appliance as the flowmon user for verification and advanced configuration (optional).

  • The Flowmon Probe can access network traffic for packet analysis.

  • If you use Flowmon ADS, you have administrative access to the Flowmon Collector where Flowmon ADS is installed.

Note:

The Flowmon IDS Probe package is provided free of charge and does not require a separate license. You can only use it with a Flowmon Probe that has valid support coverage. The IDS Probe is not covered by the Flowmon support service.

To install the IDS Probe module:

  1. Download the IDS Probe package from the support portal.

  2. Upload and install the package on your Flowmon Probe in Configuration Center > Versions.

  3. After installation, the IDS Probe module will appear in the Versions section of the Configuration Center.

After installing the IDS Probe module, you must configure the system to export, collect, and process IDS events. The setup process depends on your deployment architecture:

  • Single-appliance deployment: Flowmon ADS is installed on the same appliance as the Flowmon Probe (for example, a Flowmon Collector virtual appliance with a built-in Flowmon Probe). In this case, skip Steps 2 and 3, and then complete Step 4.

  • Multi-appliance deployment: Flowmon ADS is installed on a separate Flowmon Collector appliance, while the IDS Probe is installed on one or more Flowmon Probes. Complete Steps 1 through 4 below.

  • Custom deployment: You can send IDS events to any syslog target (not just a Flowmon Collector with Flowmon ADS) by completing Steps 1 and 2 below.

Note:

You can send IDS events to multiple syslog targets simultaneously. You can configure the IDS Probe to send events to Flowmon ADS and to additional external syslog servers for integration with third-party Security Information and Event Management (SIEM) systems or other monitoring tools.

Step 1: Enable the IDS Probe on your Monitoring Ports

  1. Go to Configuration Center > Monitoring Ports. You can either enable the IDS Probe for all monitoring ports under Global Settings > IDS Probe, or enable it only for specific monitoring ports.

  2. Enable IDS Probe.

  3. Click Save to apply the settings.

Step 2: Configure Syslog Event Logging on the Probe

Configure the Flowmon Probe to export IDS events through syslog to your syslog server (for example, a Flowmon Collector running Flowmon ADS).

  1. Go to Configuration Center > System > System Settings > Syslog Event Logging.

  2. Enable Syslog Event Logging.

  3. Click New Syslog Server.

  4. Enter the following information:

    • IP Address: The IP address of the Collector with Flowmon ADS
    • Port: The syslog port (default: 514)
    • Protocol: Select the appropriate protocol (UDP or TCP)

  5. Click Save to apply the settings.

Note:

IDS events are sent to all servers defined in Syslog Event Logging settings regardless of the "Configure Syslog Message" group selections.

Step 3: Configure the Syslog Server on the Collector

To configure the syslog server on the Collector, follow these steps:

  1. Go to Configuration Center > System > System Settings > Syslog Server on the Collector.

  2. Enable External Syslog.

  3. Click New Syslog Client.

    • IP Address: The IP address of the Flowmon Probe that sends IDS events.

    • Port: The syslog port (must match the port configured in Step 2).

    • Protocol: The protocol (must match the protocol configured in Step 2).

  4. Click Save to apply the settings.

  5. Repeat this configuration for each Flowmon Probe with the IDS Probe module that will send events to this Collector.

Step 4: Enable the Collection of IDS Events in Flowmon ADS

Enable the IDS Collector in Flowmon ADS to process, store, and visualize IDS events:

  1. Go to ADS Settings > System Settings > IDS Collector.

  2. Click Activate.

Once activated, IDS events will be available for analysis on the Analysis page in Flowmon ADS.

Verification

To verify that the IDS Probe is working correctly:

  1. Check that detected IDS events are stored in the /data/idsp/outputs/eve.json file on the Flowmon Probe.

  2. Verify that IDS events appear on the Analysis page in Flowmon ADS.

  3. Check the IDS Probe status in Configuration Center > Versions > IDS Probe.

Advanced Syslog Configuration

IDS events are stored locally in the /data/idsp/outputs/eve.json file on the Flowmon Probe. The JSON file is processed by syslog-ng according to the configuration file /etc/syslog-ng/conf.d/idsp.conf.

For advanced syslog configuration or custom event formatting, you can manually edit the idsp.conf file. Refer to the syslog-ng documentation for configuration syntax.

Using Third-Party Suricata IDS

If you are already running Suricata IDS on a separate server, you can integrate it with Flowmon ADS without installing the IDS Probe module:

  1. Configure your Suricata IDS to export events through syslog to the Flowmon Collector.

  2. Complete Step 3 and Step 4 described above.

Next Steps

After completing the basic setup:

Alert