8.0 Visualizing and Analyzing Network Flow Data

Sentinel provides a graphical representation of the statistical network flow data that helps you identify and analyze suspicious activities in your network. You can view the network flow data in real-time for a specific department, for a specific customer, a specific event, an IP address, or a time range.

To view and analyze the network flow data, you must first configure Sentinel for network flow data collection. To configure network flow data collection, you must either be an administrator or have the Send NetFlow data permission. For more information about configuring network flow data collection, see Visualizing Network Traffic in the NetIQ Sentinel Administration Guide.

NOTE:To view the network flow data, you must have the View NetFlow data permission.

To view the NetFlow data:

  1. Log in to the Sentinel Web interface as a user with the View NetFlow data permission.

  2. Perform either of the following:

    • To view real-time network flow data for a specific department or a tenant:

      1. In the navigation panel, click Real-time Monitoring > NetFlow > Create.

      2. Specify the following information:

        Tenant: If you are in a multi-tenant environment, select the department or the tenant name for which you want to view network flow data. Otherwise, select Default.

        Address: Specify the IP address for which you want to view the network flow data. By default, Sentinel provides the network flow data for the entire network.

        Time Range: Specify the time range for which you want to view the network flow data.

      3. Click Monitor NetFlow.

    • To view network flow data for a specific event:

      1. Perform a search to view the desired events.

      2. In the search results, click the NetFlow icon for the Source IP address or the Destination IP address of the event.

Sentinel provides a graphical representation the network flow data, which automatically refreshes every 10 minutes. You can hover the mouse over the graphs to monitor the incoming and outgoing number of bytes, packets, and flows for the specified tenant or IP address. Sentinel also helps you analyze the network traffic by providing a summary of the top 10 hosts and top 10 ports sending data to the specified tenant or IP address. Similarly, you can view the top 10 hosts and top 10 ports to which the specified tenant or IP address is sending data.

If you want to analyze the data in detail for a specific time, you can take a snapshot of the graph and analyze the data at the desired time.You can also compare the changes in the network traffic before and after the security event.