Dashboards
The App dashboards are organized into logical groups, and could be accessed from the top navigation bar and drop-down menus.
Overview is the default dashboard showing high level traffic statistics, such as top talkers, top listeners, traffic by protocol, traffic by protocol and destination ports, and top devices and interfaces by traffic volume.
Hosts group has dashboards to view traffic statistics from communicating peers point of view. For example, Traffic by Source IP dashboard shows top talkers, and the ability to drill down to communicating peers as well as seeing network devices that reported these network conversations. This group includes the following dashboards:
Traffic by Source IP
Traffic by Source IP with TCP Duration
Traffic by Destination IP
Traffic by Protocol and Port
Traffic by Host Pairs
Traffic by Protocol
Traffic by Subnets
Connection Details >
Interfaces group has dashboards to view traffic statistics starting from network devices and interfaces. These dashboards allow you to drill down and see network conversations traversing network devices and interfaces. This group includes the following dashboards:
Top Devices by Traffic
Top Devices by Packet Rate
Interfaces Utilization
Interfaces Utilization with Traffic by ports, source/destination, CBQOS
Watched Interfaces Utilization
Interface Groups
Applications group has dashboards to view traffic statistics and usage of various applications and services. This group includes the following dashboards:
Traffic by Protocol and Port
Service Response Time
Palo Alto Networks Top Applications
Palo Alto Networks Top Applications and Users
Cisco AVC Top Applications
Cisco AVC Top Applications and Users
Cloud group has dashboards to view traffic reported by your public cloud such as Amazon AWS, Microsoft Azure, and Google GPC. This group includes the following dashboards:
AWS Traffic Overview
AWS Traffic Overview Accepts-Rejects
AWS Traffic by Source EC2 Instance
AWS Traffic by Destination EC2 Instance
AWS Traffic by Protocol and Port
AWS Traffic by Protocol
AWS Traffic by VPC
AWS Traffic by Region
AWS Traffic by Service
AWS Visitors by Country
Azure Traffic Overview
Azure Traffic Overview Accepts-Rejects
Azure Inbound Traffic
Azure Outbound Traffic
Azure Traffic by Protocol and Port
Azure Traffic by Protocol
Azure Traffic by VPC
Azure Traffic by Region
Azure Traffic by Service
Azure Visitors by Country
GCP Traffic Overview
GCP Traffic by Source VM
GCP Traffic by Destination VM
GCP Traffic by Protocol and Port
GCP Traffic by Protocol
GCP Traffic by VPC
GCP Traffic by Zone
GCP Visitors by Country
Security group has dashboards to view malicious and unexpected traffic, as well as denied traffic reported by firewalls. This group includes the following dashboards:
Cyber Threat Statistics
DNS Security
Cisco ASA Top Violators
Palo Alto Networks Top Violators
NSX Distributed Firewall Top Violators
Protected Assets Access Monitor
Firewalls group has dashboards to view traffic reported by your firewalls:
Cisco ASA
Palo Alto Networks
VMware NSX Distributed Firewall
This group has various dashboards that don't belong to any groups mentioned above. They are:
Top Talkers and Destinations with City Geolocations
TCP Health
Visitors by Country
Traffic by Autonomous Systems
Network Traffic by CBQoS
Microsegmentation Analyzer and Planning
Traffic Analyzer and Planning (based on my-subnets.csv lookup)
These dashboards visualize SNMP polling feature of NetFlow Optimizer. They include:
SNMP interface errors and discards
SNMP CISCO - latest memory/cpu values
These dashboards enable you to look back in time: search through network traffic captured in NFO and sent to Splunk when NFO "Replay" is pressed.
This group contains dashboards to search through raw events during investigations, run online and scheduled reports, and configure alerts.
Every dashboard has different filters at the top of the screen to enable further narrowing of the report. For example, the Traffic by Protocol and Port dashboard can be filtered by the NFO hostname, device group, device, source IP/mask, source port, destination IP/mask, destination port, protocol Advanced Filter and time range.
Please note that source and destination IP/mask filters could be specified as subnets (IP/mask), as full IP addresses (199.45.1.45), or as a partial IP address (199.45.1.*).
In Advanced Filter you can specify any SPL to be appended to your search criteria, for example
src_ip!=10.* and dest_ip=192.*
Starting with release 3.7.81 the timeline panel enables you to “pan and zoom” into specific time period. The selected time interval is propagated into all drilldown panels as shown below.
