Hello community, as we know Bindplane now handles NetFlow data thankfully, I am reviewing the SecOps documentation and attempting to create a dashboard to help better visualize this data and while I am building out something I wanted to check in here to see if anyone else has faced similar and how they might have tackled the question..
Question
Visualize NetFlow Data (Dashboard)
+9- Bronze 1
Since Bindplane is handling the NetFlow ingestion, Iād build the dashboard from the normalized UDM rather than the raw NetFlow fields.
Google SecOps already has a Network Traffic Overview dashboard/query set that can be used as a baseline. It keys off network event types such as NETWORK_FLOW and NETWORK_CONNECTION and includes examples for top source IPs, destination IPs, bytes sent, traffic direction, protocol, and related network metrics.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.