Inbound event source · v1.0.0

NetFlow, IPFIX and sFlow (through an edge adapter) (inbound event source)

Flow records summarised at the edge (the netflow-adapter pack: goflow2 collects NetFlow v5/v9, IPFIX and sFlow; Vector reduces them per minute to the top talkers).

Customers: sign in to download Request a demo

Use cases

Each record is one source, destination, port and protocol over one minute, written as the counters netflow.bytes and netflow.packets into one metric object; a record the edge marked over its threshold is also recorded as external.netflow.top_talker.
Raw flows never reach Keystone.
Give the adapter this event source's address and secret (Authorization: Bearer <secret>).

NetFlow, IPFIX and sFlow (through an edge adapter)inbound event source