Modules Guide
The Modules Guide is a comprehensive technical reference for the intelligence layer of NetFlow Optimizer. While the NFO Engine handles high-performance ingestion, Modules provide the analytical logic required to turn raw telemetry into actionable security and operational insights.
Overview: Modules and Converters
NFO uses a modular architecture to process telemetry. This allows you to enable only the specific intelligence your environment requires, optimizing system resources.
- Modules: The "brains" of the operation. Modules analyze incoming flow data, apply statistical models, or correlate external context (Threat Intel, User Identity) to generate enriched events.
- Converters: These work in tandem with modules to format data for specific destinations, ensuring output is perfectly structured for platforms like Splunk, Microsoft Sentinel, or generic JSON/Syslog collectors.
How to Use This Guide
Each module documented in this guide includes the following technical details:
- Functionality: A detailed explanation of the module's logic and use cases.
- Configuration Parameters: A reference for tuning thresholds, intervals, and in-memory enrichment databases.
- Output Fields: A complete schema of fields added to the enriched flow, essential for building SIEM dashboards and detection rules.
Flow Analytics Modules
Primary Modules
Which one should I use?
| Feature | Top Traffic (10067) | Network Conversations (10062) |
|---|---|---|
| Primary Function | Consolidation of unidirectional flows — high-traffic host reporting | Detailed bidirectional conversation reporting |
| Volume Reduction | Collection interval, Top N by volume, deduplication, ignore client ports | All Top Traffic options, plus bidirectional stitching, conversation duration, and full enrichment |
| Enrichment | DNS names only | Applications, VM names, users, threat reputation |
| Deduplication | Optional | Same as Top Traffic |
| Output Format | Fixed schema | Configurable field selection |
Recommendation: Use Network Conversations (10062) as your default for security analytics and full visibility. Use Top Traffic (10067) when maximum throughput with minimal processing overhead is the priority, or when bandwidth summary reporting is the primary goal.
Additional Flow Modules
Infrastructure & Device Telemetry (SNMP)
Beyond flow data, NFO includes a dedicated SNMP service for hardware health. These modules provide device-level metrics — CPU/Memory utilization, interface errors and discards — that flow data cannot capture.
Legacy Modules & Migration Guide
As NFO has evolved, vendor-specific, cloud-specific, and early-generation modules have been consolidated into the Unified Flow Analytics engine. This consolidation provides superior performance, bidirectional stitching, and a standardized data schema across your entire infrastructure.
Migration Path
If you are currently using any of the modules listed below, migrate to the recommended replacement. These current modules now handle all functionality previously found in the specialized collectors.
Detailed specifications for deprecated modules are maintained in the v2.11.2 Documentation Archive.
| Legacy / Deprecated Module | Module ID | Recommended Migration |
|---|---|---|
| SNMP Information Monitor | 10003 | SNMP Custom OID Sets (10103) |
| Network Traffic & Devices | 10063, 10064, 10066, 10068 | Top Traffic Monitor (10067) |
| Amazon AWS VPC Flow Logs | 10267, 10201 | Network Conversations (10062) |
| Microsoft Azure NSG Flow Logs | 10467, 10401 | Network Conversations (10062) |
| Google Cloud VPC Flow Logs | 10367, 10301 | Network Conversations (10062) |
| Cisco ASA Monitoring | 10018 - 10021 | Network Conversations (10062) |
| Palo Alto Networks Monitoring | 10030 - 10037 | Network Conversations (10062) |
| Cisco AVC (App Visibility) | 10434 - 10435 | Network Conversations (10062) |
| VMware / NSX Monitoring | 10164 - 10167, 10118, 10264 | Network Conversations (10062) |
| Email Analytics (Legacy) | 10025 - 10028 | Network Conversations (10062) |
Why Migrate?
- Cost Reduction: Eliminates data overlap — deprecated modules often reported the same telemetry in different formats, causing redundant SIEM ingestion.
- Better Volume Reduction: Modules 10062 and 10067 offer superior deduplication and aggregation compared to legacy sets.
- Bidirectional Intelligence: Legacy modules reported unidirectional "halves." Network Conversations (10062) stitches them into a single complete record.
- Unified Schema: Ensures compatibility with the latest NetFlow Logic Apps for Splunk, Microsoft Sentinel, and Elastic.
How to Migrate
- Identify: Check your NFO Web UI for modules marked with a Deprecated warning.
- Enable Replacement: Enable Module 10103 for SNMP polling, Module 10062 for full enrichment and bidirectional flow analytics, or Module 10067 for high-volume traffic summaries.
- Validate: Confirm the new data is reaching your SIEM and meets your reporting requirements.
- Disable Legacy: Disable the legacy module immediately after validation to prevent duplicate data and save system resources.