Troubleshooting
Problem
After adding a flow processor to deployment, flows that are received do not have the expected directions. This might result in traffic that is expected as being Local instead appearing as Remote.
Symptom
After a flow processor is added, flows are received but their direction does not match the expected results. IP Ranges might appear as remote even if they are configured in your network hierarchy.
Cause
When your deployment includes non-default domains, your network hierarchy can have non-default domain configurations. If the added flow collector is not assigned to the same domain as the IP range in question, that IP range will be recognized as a remote network.
Diagnosing The Problem
You can verify the domain configuration of the IP range in question by going to the following location on the QRadar User Interface: Admin > System Configuration > Network Hierarchy.
Resolving The Problem
To assign the flow collector to a domain, follow the procedure below:
- In the QRadar UI, select Admin > System Configuration > Domain Management.
- Select the domain in which the collector will be included and click Edit.
- From the Edit Domain screen, select Flows.
- Click Flow Collectors, find the added flow collector from the drop-down, and click Add.
- Click Save.
Where do you find more information?
Related Information
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg22001012