From 367300296ab5ac855f2767213cdd7eb849d74a89 Mon Sep 17 00:00:00 2001 From: Carla Garcia <167806437+CG3827@users.noreply.github.com> Date: Fri, 14 Feb 2025 11:41:27 -0500 Subject: [PATCH 1/7] Create NetFlow Content Pack.html --- Content/Content Packs/NetFlow Content Pack.html | 1 + 1 file changed, 1 insertion(+) create mode 100644 Content/Content Packs/NetFlow Content Pack.html diff --git a/Content/Content Packs/NetFlow Content Pack.html b/Content/Content Packs/NetFlow Content Pack.html new file mode 100644 index 00000000..c054f7a8 --- /dev/null +++ b/Content/Content Packs/NetFlow Content Pack.html @@ -0,0 +1 @@ +nf From 2ef7ac13edaabc80779a244d9dc249d7fa02cf76 Mon Sep 17 00:00:00 2001 From: Carla Garcia <167806437+CG3827@users.noreply.github.com> Date: Thu, 20 Feb 2025 19:45:40 -0500 Subject: [PATCH 2/7] Update NetFlow Content Pack.html --- .../Content Packs/NetFlow Content Pack.html | 136 +++++++++++++++++- 1 file changed, 135 insertions(+), 1 deletion(-) diff --git a/Content/Content Packs/NetFlow Content Pack.html b/Content/Content Packs/NetFlow Content Pack.html index c054f7a8..4b45a7e5 100644 --- a/Content/Content Packs/NetFlow Content Pack.html +++ b/Content/Content Packs/NetFlow Content Pack.html @@ -1 +1,135 @@ -nf + + +
+
NetFlow is a network protocol that collects and monitors IP traffic flow data, providing insights into network usage, security threats, and performance. It helps analyze traffic patterns, detect anomalies, and troubleshoot network issues by capturing details such as source/destination IPs, ports, protocols, and bandwidth usage. +
NetFlow running versions are NetFlowV5, NetFlowV9, IPFIX.
+Graylog Server with a valid enterprise license, running Graylog version 6.0.1+.
+
+
N/A
+This technology pack includes one stream:
+“Illuminate:NetFlow Messages”
+
+
This technology pack includes one index set definition:
+“NetFlow Firewall Logs”
+
+
id=firewall time="2022-11-25 16:30:33" fw="SN710_ABCD" tz=+0100 startime="2022-11-25 16:30:32" pri=5 confid=01 slotlevel=2 ruleid=208 srcif="vlan4" srcifname="20_SOMETHING" ipproto=tcp dstif="vlan3" dstifname="1000_XYZ" proto=http_proxy src=10.10.20.13 srcport=42006 srcportname=ephemeral_fw_tcp srcname=SOMENAME srcmac=xx:6b:8d:9a:da:13 dst=192.168.1.1 dstport=8080 dstportname=http_proxy dstname=Protect-DMZ ipv=4 sent=0 rcvd=0 duration=0.00 action=pass logtype="filter"
+
Configure NetFlow to transmit Syslog to your Graylog server Syslog input.
+Rules to normalize and enrich NetFlow log messages.
+A Network Overview Spotlight content pack (dashboard).
+The Illuminate processing of NetFlow log messages provides the following:
+Field extraction and normalization and message enrichment for NetFlow log messages.
+GIM Categorization of the following messages:
+NetFlow Logtype | +GIM Category | +GIM Subcategory | +
---|---|---|
filter | +network | +network.flow
+ |
+
The Network Overview Spotlight content pack contains:
+Dashboard: Network Overview
+Network Overview tab
+
+
+
+
+
+
+
Graylog Server with a valid enterprise license, running Graylog version 6.0.1+.
-
-
N/A
-This technology pack includes one stream:
id=firewall time="2022-11-25 16:30:33" fw="SN710_ABCD" tz=+0100 startime="2022-11-25 16:30:32" pri=5 confid=01 slotlevel=2 ruleid=208 srcif="vlan4" srcifname="20_SOMETHING" ipproto=tcp dstif="vlan3" dstifname="1000_XYZ" proto=http_proxy src=10.10.20.13 srcport=42006 srcportname=ephemeral_fw_tcp srcname=SOMENAME srcmac=xx:6b:8d:9a:da:13 dst=192.168.1.1 dstport=8080 dstportname=http_proxy dstname=Protect-DMZ ipv=4 sent=0 rcvd=0 duration=0.00 action=pass logtype="filter"
+
NetFlowV5 [192.168.81.254]:67 <> [192.168.81.134]:68 proto:17 pkts:1 bytes:328
Configure NetFlow to transmit Syslog to your Graylog server Syslog input.
+Configure NetFlow to transmit Syslog to your Graylog server Syslog input. Customer needs to use the NetFlow UDP. You also need to install fprobe. fprobe will send the collected flow data. + +
+ +You can now install fprobe using:
+sudo apt-get install fprobe
+
+ fprobe requires two configuration parameters:
+127.0.0.1:2055
in this case)You can modify these settings in the configuration file:
+/etc/default/fprobe
+
+ Restart fprobe to apply the configuration:
+sudo service fprobe restart
+
+ If everything is configured correctly, new files will appear in /var/cache/nfdump
. Verify by listing the files:
ls -lh /var/cache/nfdump
+ Rules to normalize and enrich NetFlow log messages.
A Network Overview Spotlight content pack (dashboard).
-The Illuminate processing of NetFlow log messages provides the following:
@@ -100,36 +154,8 @@The Network Overview Spotlight content pack contains:
-Dashboard: Network Overview
-Network Overview tab
-
-
-
-
-
-
-
It does not have a spotlight, but you can use the Illuminate:Core; Network Overview spotlight to show network related messages.
+