Skip to main content
Version: Next

EDFN Administration Guide

External Data Feeder for NFO performs the following functions:

  • Enables ingestion of cloud flow logs, such as Amazon Web Services (AWS), Microsoft Azure, Oracle Cloud Infrastructure (OCI), and Google Public Cloud (GCP)
  • Enables reading and automatic updates of information outside of the NetFlow domain used for enrichment, such as security threat lists, Geo IP information (integration with MaxMind or IP2Location), VM names (integration with VMware vCenter), User identity (integration with Active Directory and other identity systems)

Configuring External Data Feeder for NFO​

External Data Feeder is installed and configured automatically with NFO. After the installation go to External Data Feeder on the left navigation bar. You should see this:

For enhanced security and communication control, EDFN offers additional configuration options beyond the basic setup. These options are covered in detail within the EDFN Administration Guide. Here's a brief overview:

  • Authentication Configuration: This section details how to establish secure communication between NFO and EDFN agents. Configuring authentication ensures only authorized agents can communicate with NFO, protecting your data from unauthorized access.

  • Proxy Server Configuration: If your network utilizes a proxy server, this section guides you through configuring EDFN to access external resources through the proxy. This ensures smooth communication even within environments with specific network access controls.

  • Import HTTPS Certificates for EDFN Agents Secure Connections: To establish encrypted communication between EDFN agents and data sources, you can import HTTPS certificates, further bolstering the security of your data exchange.

If you install several instances of External Data Feeder for NFO you can configure the first instance, and then copy configuration from the first instance to another one. Please see Copying External Data Feeder for NFO Configuration section.

Verifying External Data Feeder for NFO Status​

Verifying External Data Feeder for NFO Linux Installation​

Procedure

To verify if External Data Feeder for NFO is running perform the following:

  1. Check the status (see Working with External Data Feeder for NFO Service)
  2. For the list of available commands (see Working with External Data Feeder for NFO Service)

Verifying External Data Feeder for NFO Windows Installation​

Procedure

Use Windows Services to check External Data Feeder for NFO status