On write, the new value wins
Repeated deliveries are the common case: a network drop, an agent retry. If volumes were summed, every repetition would double them and nobody would see it. So a delivery replaces the window instead of adding to it.
IT Asset & Network
Network flow data
Who talks to whom, how much and when, never what
Until now isidaten knew who hangs where: assets, racks, switch ports, networks. What was missing was the traffic. The module keeps the time series of who talks to whom in the network, how much and when, and it does so with a clear boundary: what is stored is a bucket, one connection pair in one time window with source, destination, port, protocol and volumes. Aggregation happens at the source, never here, because one datagram per connection would be neither sustainable nor the same question under data protection law. Connection matrix, time series and hunting do not distinguish between traffic from your own network and from the cloud.
ISO 27001BSI IT-Grundschutz NET.1.1DSGVO
Features
Your benefits
The sampling rate is carried along, not baked in
Many switches export only every hundredth packet. If the rate is wrong, all volumes are off by the same factor, and the number does not show it. Whoever extrapolates should do so visibly. A core switch and the firewall behind it are two measurements, not a duplicate, and are kept apart.
Cloud traffic via the existing sign-in
AWS VPC flow logs from S3 and Azure NSG flow logs via Traffic Analytics are fetched through the CSPM account; the sign-in is not built a second time. The header line of every AWS file determines the columns, because an added field otherwise shifts everything behind it, and numbers in the wrong place are still numbers.
Capabilities
All capabilities at a glance
- NetFlow v5 and v9, IPFIX, sFlow from switches and routers; traffic logs from FortiGate and Palo Alto
- AWS VPC flow logs from S3 and Azure NSG flow logs via Traffic Analytics, through the CSPM account
- Buckets per time window with source, destination, port, protocol and volumes; no individual flows, no payload
- Sources create themselves once a collector delivers; sampling rate carried per source
- Idempotent delivery: window replaced, parts of the same delivery summed, unknown fields reported
- Time series, connection matrix and hunting across own network and cloud
- Conspicuous buckets as SIEM events into correlation, incident and rule chain
- Basis of the communication matrix in the OT security module and of the target-actual comparison in firewall management
Result
Traffic in the network as a traceable time series, with a storage boundary that can be explained in one sentence in the data protection conversation.
Background
Articles on Network flow data
Experience Network flow data live
Schedule a no-obligation demo – we will show you the module with your own use cases.