Question & Answer
Should I add new flow sources for every new external flow source sent to QRadar?
If you navigate to the Admin tab and click the Flow Sources icon, there should be one default_Netflow out of the box for Console, but then new flow sources are created as you add flow collection products such as Flow Collector 12xx, Flow Collector 13xx, Flow Processor 17xx, Flow Processor 18xx.
QNI 19xx series Appliances are an exemption as they utilize external flow sources such as default_Netflow.
A Flow Source should only reflect the way your QRadar environment listens to flow traffic over specific ports or interfaces. You do not need to add a new flow source for every flow source you are sending to QRadar. For example, if you are sending only sending NetFlows to an onboard copper Ethernet interface on the Console over port 2055 and a fiber interface on a Flow over port 2056, then your flow source configuration should only have these two flow sources Enabled. You can disable all the rest of the interfaces out of box. Flow sources configurations allows QRadar flow collectors to open firewalls to accept flows over the specific interface or ports to ingest your external flow data.
As you continue to send new flow sources to QRadar, new flow source aliases will be autodetected and created in flow source aliases. These will also appear in the Flow Interface column on the Network Activity screen. To verify the new flow sources.
- From the Admin page click the Network Activity tab
- Click Add Filter
- Choose a Flow Interface to look for the new flow data that is being ingested by QRadar.
To see traffic being sent to QNI use this procedure.
- Click Network Activity tab
- Click Add Filter
- Choose a QNI Flow Interface.
Your interface should be flow_processor_component_hostname:qni_hostname. For example if your flow processor hostname is qfp1 and your QNI hostname is qni1, then your flow interface would be qfp1:qni1
Was this topic helpful?
06 February 2019