Configuring App flow monitor to view real-time incoming and outgoing network data

03/26/2020 355 16191

DESCRIPTION:

The App Flow Monitor provides administrators with real-time, incoming and outgoing network data. Various views and customizable options in the App Flow Monitor Interface assist in visualizing the real-time traffic data pertaining to Applications, Users, URLs, Initiators, Responders, Threats, VoIP, VPN, Devices and Content.

RESOLUTION:

App Flow Monitor | Status:

The App Flow Monitor Status dialog appears when the cursor rolls over the Status button in the toolbar. The App Flow Monitor Status provides updates about the App Signatures, GAV Database, Spyware Database, IPS Database, and Country Database. The dialog also informs administrators about the Content Filtering Service (CFS) status and Max Flows in the Database. The option to enable or disable the flow collection is available in the Status dialog. If the Status dialog is no longer wanted, click close in the upper-right corner.

App flow monitor | Group Options/Tabs: The Group option sorts data based on the specified group. Each tab contains different grouping options.

• The Applications tab can be grouped by:
  
  – Application: Displays all traffic generated by individual applications.
  – Category: Groups all traffic generated by an application category. 

• The Users tab can be grouped by:
  
  – User Name: Groups all traffic generated by a specific user.
  – IP Address: Groups all traffic generated by a specific IP address.
  – Domain Name: Groups all traffic generated by a specific domain name.
  – Auth Type: Groups all traffic generated by a specific authorizing method.

TIP: For the User Related details, please make sure you have User Level Authentication methods set like Local User , LDAP,RADIUS . For more information , please visit : Help with User level authentication settings like Local Users, LDAP, RADIUS

• The URL tab can be grouped according to:
  
  – URL: Displays all traffic generated by each URL.
   – Domain Name: Groups all traffic generated by a domain name.
  – Rating: Groups all traffic generated based on CFS rating.  

• The Initiators tab can be grouped according to:
  
  – IP Address: Groups all traffic generated by a specific IP address.
  – Interface: Groups all traffic according to the firewall interface.
  – Country: Groups all traffic generated by each country, based on country IP database.
  – Domain Name: Groups all traffic generated by a domain name.

• The Responders tab can be grouped according to:
  
  – IP Address: Groups all traffic by IP address.
  – Interface: Groups responders by interface.
  – Country: Groups responders by each country, based on country IP database.
  – Domain Name: Groups responders by domain name.

• The Threats tab can be grouped according to:
  
  – Intrusions: Displays flows in which intrusions have been identified.
  – Viruses: Displays flows in which viruses have been identified.
  – Spyware: Displays flows in which spyware has been identified.
  – Spam: Shows all flows that fall under the category of spam. Refresh Rate Rate at which data is refreshed. A numeric integer between 10 and 999 must be specified. If 300 is entered in the numeric field, that means the data flow will refresh every 300 seconds. Pause/Play Freezes and unfreezes the data flow. Doing so gives the administrator flexibility when analyzing real-time data.

• The VoIP tab can be grouped according to:
  
  – Media Type: Groups VoIP flows according to media type.
  – Caller ID: Groups VoIP flows according to caller ID.
• The VPN tab can be grouped according to:
  
  – Remote IP Address: Groups VPN flows access according to the remote IP address.
  – Local IP Address: Groups VPN flows access according to the local IP address.
  – Name: Groups VPN flows access according to the tunnel name.
• The Devices tab can be grouped according to:
  
  – IP Address: Groups flows by IP addresses inside the network.
  – Interface: Groups flows by interfaces on the firewall.
  – Name: Groups flows by device name, or MAC address.
• The Contents tab can be grouped according to:
  
  – Email Address: Groups contents by email address.
  – File Name: Groups flows by file type detected.