QRadar: Network Activity does not display real-time streaming flow data

Troubleshooting

Problem

The Network Activity tab does not display real-time streaming flow data.

Resolving The Problem

Two possible resolutions for this issue are to:

Verify that connected routers and switches are configured for network tap or mirroring of their SPAN port. For additional explanation see, flow data collection.
Verify that firewalls are configured to allow for network streams flows and not EVENT-based streams. Firewalls are events-based flows and not network packet-based flows.

For example, see QRadar: Cisco ASA Netflow NSEL - Byte & Packet counts blank and QRadar: About flows and the difference between QFlow Collector and QRadar Event Collector.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsuAAA","label":"Flow Source"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Historical Number

19628;442;000

Was this topic helpful?

Document Information

Modified date:
02 November 2022

UID

swg21995428

Tips