How to enable Security Analytics?

Advanced Analytics Security Module (ASAM) is an add-on in NetFlow Analyzer. You can enable Security module  from Settings.

1. Navigate to Settings > NetFlow > Security Analytics
2. Click on "Enable" to enable Security module

Note: Make sure you have purchased the license for Security module.

How to customize problem events?

1. Navigate to Settings > NetFlow > Security Analytics
2. Click on "Manage Problems"
3. Select any problem type and select the sub-category for problem
4. Disable unwanted problem names under that class

How to customize resources?

1. Navigate to Settings > NetFlow > Security Analytics
2. Click on "Manage Resource"
3. Select RIP/IP/NET and select the resources
4. Disable unwanted resources
5. If you want to enable any particular resource, click on "Disable List" and follow the same procedure

How to customize ASAM algorithm ?

1. Navigate to Settings > NetFlow > Security Analytics
2. Click on "Manage Algorithm"
3. Select any algorithm type and select its sub-category
4. Disable unwanted categorization for problems under that class

How to customize the threshold for events?

ASAM has predefined the threshold for every problem class and its classification. It is possible to edit thresholds for each problem type from Settings.

1. Settings > NetFlow > Attacks
2. Click on "Threshold" to edit Threshold settings
3. Click on any particular problems and edit the upper limit and lower threshold value
4. Click on Advanced Settings for more changes
5. Save

How to create an alert profile for ASAM?

You can generate alerts and get notified in case of any threshold violation for attacks.

1. Settings > NetFlow >Security Analytics
2. Click on "Alert Profiles" to edit / add a new alert notification
3. Select Algorithm
   

   

4. Next, provide Criteria

   

5. Add the profile with name, retention period, notification details.
6. Save