Dashboards

App Navigation Overview

The App dashboards are organized into logical groups, and could be accessed from the top navigation bar and drop-down menus.

Overview

Overview is the default dashboard showing high level traffic statistics, such as top talkers, top listeners, traffic by protocol, traffic by protocol and destination ports, and top devices and interfaces by traffic volume.

Hosts

Hosts group has dashboards to view traffic statistics from communicating peers point of view. For example, Traffic by Source IP dashboard shows top talkers, and the ability to drill down to communicating peers as well as seeing network devices that reported these network conversations. This group includes the following dashboards:

  1. Traffic by Source IP

  2. Traffic by Source IP with TCP Duration

  3. Traffic by Destination IP

  4. Traffic by Protocol and Port

  5. Traffic by Host Pairs

  6. Traffic by Protocol

  7. Traffic by Subnets

  8. Traffic by Connections

Interfaces

Interfaces group has dashboards to view traffic statistics starting from network devices and interfaces. These dashboards allow you to drill down and see network conversations traversing network devices and interfaces. This group includes the following dashboards:

  1. Top Devices by Traffic

  2. Top Devices by Packet Rate

  3. Interfaces Utilization

  4. Interfaces Utilization with Traffic by ports, source/destination, CBQOS

  5. Watched Interfaces Utilization

  6. Interface Groups

Applications

Applications group has dashboards to view traffic statistics and usage of various applications and services. This group includes the following dashboards:

  1. Traffic by Protocol and Port

  2. Service Response Time

  3. Palo Alto Networks Top Applications

  4. Palo Alto Networks Top Applications and Users

  5. Cisco AVC Top Applications

  6. Cisco AVC Top Applications and Users

Cloud

Cloud group has dashboards to view traffic reported by your public cloud such as Amazon AWS, Microsoft Azure, and Google GPC. This group includes the following dashboards:

Amazon AWS

  1. AWS Traffic Overview

  2. AWS Traffic Overview Accepts-Rejects

  3. AWS Traffic by Source EC2 Instance

  4. AWS Traffic by Destination EC2 Instance

  5. AWS Traffic by Protocol and Port

  6. AWS Traffic by Protocol

  7. AWS Traffic by VPC

  8. AWS Traffic by Region

Security

Security group has dashboards to view malicious and unexpected traffic, as well as denied traffic reported by firewalls. This group includes the following dashboards:

  1. Cyber Threat Statistics

  2. DNS Security

  3. Cisco ASA Top Violators

  4. Palo Alto Networks Top Violators

  5. NSX Distributed Firewall Top Violators

  6. Protected Assets Access Monitor

Firewalls

Firewalls group has dashboards to view traffic reported by your firewalls:

  1. Cisco ASA

  2. Palo Alto Networks

  3. VMware NSX Distributed Firewall

More Traffic Statistics

This group has various dashboards that don't belong to any groups mentioned above. They are:

  1. Top Talkers and Destinations with City Geolocations

  2. TCP Health

  3. Visitors by Country

  4. Traffic by Autonomous Systems

  5. Network Traffic by CBQoS

  6. Microsegmentation Analyzer and Planning

  7. Traffic Analyzer and Planning (based on my-subnets.csv lookup)

SNMP

These dashboards visualize SNMP polling feature of NetFlow Optimizer. They include:

  1. SNMP interface errors and discards

  2. SNMP CISCO - latest memory/cpu values

These dashboards enable you to look back in time: search through network traffic captured in NFO and sent to Splunk when NFO "Replay" is pressed.

Searches, Reports, and Alerts

This group contains dashboards to search through raw events during investigations, run online and scheduled reports, and configure alerts.

Dashboard overview

Every dashboard has different filters at the top of the screen to enable further narrowing of the report. For example, the Traffic by Protocol and Port dashboard can be filtered by the NFO hostname, device group, device, source IP/mask, source port, destination IP/mask, destination port, protocol Advanced Filter and time range.

Please note that source and destination IP/mask filters could be specified as subnets (IP/mask), as full IP addresses (199.45.1.45), or as a partial IP address (199.45.1.*).

In Advanced Filter you can specify any SPL to be appended to your search criteria, for example

src_ip!=10.* and dest_ip=192.*

Starting with release 3.7.81 the timeline panel enables you to “pan and zoom” into specific time period. The selected time interval is propagated into all drilldown panels as shown below.