You can automatically collect all flow records, which are network-layer
communications between two devices over an IP protocol. If you enable this feature, but do
not add any IP addresses or port ranges, all detected flow records are captured.
Configuring flow records for automatic collection is fairly straight-forward and
can be a good way to test that your Explore appliances or third-party recordstore are
connected.
-
Log into the Admin UI on your Discover appliance.
-
In the Records section, click Automatic Flow
Records.
-
Select the Enabled checkbox.
-
In the Publish Interval field, type a number between 60
and 21600. This value determines how often records from an active flow are sent
to the Explore appliance. The default value is 1800 seconds.
-
In the IP Address field, type a single IP address or IP
address range in IPv4, IPv6, or CIDR format. Then, click the green plus
(+) icon. (You can remove an entry by clicking the
red delete (X) icon.)
-
In the Port Ranges field, type a single port or port
range. Then, click the green plus (+) icon.
-
Click Save.
Flow records that meet your criteria are now automatically sent to your
configured recordstore. Wait a few minutes for records to be collected, and then
verify that flow records are being collected in the next step.
-
In the Web UI, click Records from the top menu to start
a query. If you do not see any records, wait a few minutes and try again. If no
records appear after five minutes, review your configuration or contact ExtraHop
Support.
Thank you for your feedback. Can we contact you to ask follow up questions?