Superflows

IBM QRadar analyzes individual flows to look for indicators that common attack vectors are being used on your network. When the number of flows that match the criteria reaches a specified number, QRadar groups the individual flows into a superflow. Each superflow counts as only one flow against the flows per minute (FPM) license, regardless of how many flow records are bundled within it.

You can configure the flow threshold to control the number of unique flows that must match the criteria before a superflow is created. Given a threshold of 100, the first 99 flows are sent as normal flow records. The 100th flow and subsequent matching flows are included in the superflow record. QRadar continues to report on the superflow every minute until one full interval passes with no matching traffic. Because a superflow is kept alive even if only one flow record matches, some superflows might appear to be small.

Tip: If you do not want QRadar to create superflows, in the Flow Collector configuration settings, change the Create Super Flows setting to No.

Superflow Type A: Network scan

A network scan attempts to discover all of the active hosts on your network and map the hosts to an IP address.

QRadar looks for flows where one host sends data to many hosts, and flags this type of activity as a Type A superflow. This unidirectional flow is an aggregate of all of the flows that have the same source IP with different destination IPs, but the following parameters are the same:
  • Protocol
  • Source bytes-to-packets ratio
  • Source IP address
  • Destination port (TCP and UDP flows only)
  • TCP flags (TCP flows only)
  • ICMP type and code (ICMP flows only)
QRadar product interface showing multiple Type A superflows on the Network Activity tab.

Superflow Type B: Distributed denial of service (DDoS)

A DDoS attack occurs when multiple systems flood the bandwidth or resources of a targeted system.

QRadar looks for flows where many hosts send data to one destination host, and flags this activity as a Type B superflow. This unidirectional flow is an aggregate of all of the flows that have different source IPs with a single destination IP, but the following parameters are the same:
  • Protocol
  • Source bytes-to-packets ratio
  • Destination IP address
  • Destination port (TCP and UDP flows only)
  • TCP flags (TCP flows only)
  • ICMP type and code (ICMP flows only)
QRadar product interface showing multiple Type B superflows on the Network Activity tab.

Superflow Type C: Port scan

A port scan attempts to identify the ports that are in use by a specific host on your network.

QRadar looks for flows that have one source IP and one destination IP, but many ports. This unidirectional flow is an aggregate of all non-ICMP flows that have different source or destination ports, but the following parameters are the same:
  • Protocol
  • Source IP address
  • Destination IP address
  • Source bytes-to-packets ratio
  • TCP flags (TCP flows only)
QRadar product interface showing multiple Type C superflows on the Network Activity tab.