From 367300296ab5ac855f2767213cdd7eb849d74a89 Mon Sep 17 00:00:00 2001 From: Carla Garcia <167806437+CG3827@users.noreply.github.com> Date: Fri, 14 Feb 2025 11:41:27 -0500 Subject: [PATCH 1/7] Create NetFlow Content Pack.html --- Content/Content Packs/NetFlow Content Pack.html | 1 + 1 file changed, 1 insertion(+) create mode 100644 Content/Content Packs/NetFlow Content Pack.html diff --git a/Content/Content Packs/NetFlow Content Pack.html b/Content/Content Packs/NetFlow Content Pack.html new file mode 100644 index 00000000..c054f7a8 --- /dev/null +++ b/Content/Content Packs/NetFlow Content Pack.html @@ -0,0 +1 @@ +nf From 2ef7ac13edaabc80779a244d9dc249d7fa02cf76 Mon Sep 17 00:00:00 2001 From: Carla Garcia <167806437+CG3827@users.noreply.github.com> Date: Thu, 20 Feb 2025 19:45:40 -0500 Subject: [PATCH 2/7] Update NetFlow Content Pack.html --- .../Content Packs/NetFlow Content Pack.html | 136 +++++++++++++++++- 1 file changed, 135 insertions(+), 1 deletion(-) diff --git a/Content/Content Packs/NetFlow Content Pack.html b/Content/Content Packs/NetFlow Content Pack.html index c054f7a8..4b45a7e5 100644 --- a/Content/Content Packs/NetFlow Content Pack.html +++ b/Content/Content Packs/NetFlow Content Pack.html @@ -1 +1,135 @@ -nf + + + NetFlow Content Pack + + + +

+ +

+

NetFlow is a network protocol that collects and monitors IP traffic flow data, providing insights into network usage, security threats, and performance. It helps analyze traffic patterns, detect anomalies, and troubleshoot network issues by capturing details such as source/destination IPs, ports, protocols, and bandwidth usage. +

+

+

+
Warning: This spotlight requires a more recent version of Graylog due to a change in functionality. Fields will be improperly processed if using a version earlier than Graylog 4.3.0.
+
+

+

Not Supported

+ +

Stream Configuration

+

This technology pack includes one stream:

+ +

+

+
Hint: If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.
+
+

+

Index Set Configuration

+

This technology pack includes one index set definition:

+ +

+

+
Hint: If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.
+
+

+

Log Format Example

+

id=firewall time="2022-11-25 16:30:33" fw="SN710_ABCD" tz=+0100 startime="2022-11-25 16:30:32" pri=5 confid=01 slotlevel=2 ruleid=208 srcif="vlan4" srcifname="20_SOMETHING" ipproto=tcp dstif="vlan3" dstifname="1000_XYZ" proto=http_proxy src=10.10.20.13 srcport=42006 srcportname=ephemeral_fw_tcp srcname=SOMENAME srcmac=xx:6b:8d:9a:da:13 dst=192.168.1.1 dstport=8080 dstportname=http_proxy dstname=Protect-DMZ ipv=4 sent=0 rcvd=0 duration=0.00 action=pass logtype="filter" +

+

Requirements

+ +

What is Provided

+ +

NetFlow Log Message Processing

+

The Illuminate processing of NetFlow log messages provides the following:

+ + + + + + + + + + + + + + + + + + + + +
NetFlow LogtypeGIM CategoryGIM Subcategory
filternetworknetwork.flow +
+

Network Overview Spotlight Content Pack

+

The Network Overview Spotlight content pack contains:

+ + + + From f582ba7e079c20a89bcc47158b4c4ac38e808b3a Mon Sep 17 00:00:00 2001 From: Carla Garcia <167806437+CG3827@users.noreply.github.com> Date: Mon, 24 Feb 2025 16:53:21 -0500 Subject: [PATCH 3/7] Update NetFlow Content Pack.html --- .../Content Packs/NetFlow Content Pack.html | 120 +++++++++++------- 1 file changed, 73 insertions(+), 47 deletions(-) diff --git a/Content/Content Packs/NetFlow Content Pack.html b/Content/Content Packs/NetFlow Content Pack.html index 4b45a7e5..978a29f0 100644 --- a/Content/Content Packs/NetFlow Content Pack.html +++ b/Content/Content Packs/NetFlow Content Pack.html @@ -16,17 +16,8 @@

Graylog Server with a valid enterprise license, running Graylog version 6.0.1+.

-

-

-
Warning: This spotlight requires a more recent version of Graylog due to a change in functionality. Fields will be improperly processed if using a version earlier than Graylog 4.3.0.
-
-

-

Not Supported

- + +

Stream Configuration

This technology pack includes one stream:

NetFlow Log Message Processing

The Illuminate processing of NetFlow log messages provides the following:

@@ -100,36 +154,8 @@

NetFlow Log Message Processing

-

Network Overview Spotlight Content Pack

-

The Network Overview Spotlight content pack contains:

- - +

NetFlow Overview Spotlight Content Pack

+

It does not have a spotlight, but you can use the Illuminate:Core; Network Overview spotlight to show network related messages.

+ From ae5467177a3bd6cf2eb5949ccce992e76bb74331 Mon Sep 17 00:00:00 2001 From: Carla Garcia <167806437+CG3827@users.noreply.github.com> Date: Tue, 25 Feb 2025 10:18:56 -0500 Subject: [PATCH 4/7] Update NetFlow Content Pack.html --- Content/Content Packs/NetFlow Content Pack.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Content/Content Packs/NetFlow Content Pack.html b/Content/Content Packs/NetFlow Content Pack.html index 978a29f0..384455f6 100644 --- a/Content/Content Packs/NetFlow Content Pack.html +++ b/Content/Content Packs/NetFlow Content Pack.html @@ -34,7 +34,7 @@

Index Set Configuration

This technology pack includes one index set definition:

@@ -48,7 +48,7 @@

Log Format Example

Requirements