Seeking assistance with complex NetFlow reporting request

I'm seeking assistance to construct a report (with custom chart) that displays ingress traffic rate to specific IP address groups based on multiple specific NetFlow interfaces across different nodes. It doesn't seem possible to display in NTA dashboard, so I'm evaluating reporting. However, there are several fields that are poorly explained and that I cannot find the definitions for in SWQL.

Destination IPGroupSegmentID, I cannot find the definition for. If values are provided, they don't align with numbers found for IP Address Group Name.
Ingress InterfaceID simiilarly I cannot find a definition for.

Unfortunately, an inability to find details for the above puts me an impasse. I think something like this would be ideal if the definitions were known.

Thanks for any insights you can provide.

Find more posts tagged with

Accepted answers

All comments

stibi

Hi @aidanall ,

Those IPGroupSegmentsIDs are internal mappings to IP Group ranges. You should not use them and instead I would recommend using IP Address Group name. You can select it in Advanced Selector mode. There is related entity NetFlow IP Address Group and under it is column you are looking for.

The entity is mentioned twice: once for the source and once for the destination. In my case, the first one is for the destination, and the second is for the source. I will look into it to see if we can improve it.

aidanall

Thanks for the insights, Stibi. Is there a way to determine which NetFlow IP Address Group is which direction today? Are there plans to hide fields that shouldn't be referenced by users? And then similarly, are there options other than "IDs" (since they don't seem to be preferred) for referencing specific NetFlow interfaces - similar to "Full Name" when reporting on Interfaces?

stibi

Is there a way to determine which NetFlow IP Address Group is which direction today?
I did not find a better way than just capturing the query in SWQL Studio and checking the direction in the captured query.

Are there plans to hide fields that shouldn't be referenced by users?
I created a new task for that, but it is not up to me to decide whether it will be fixed.

And then similarly, are there options other than "IDs" (since they don't seem to be preferred) for referencing specific NetFlow interfaces - similar to "Full Name" when reporting on Interfaces?
You can use any field from the interfaces entity. Even custom properties can be used, but if you know how to obtain interface IDs, I recommend sticking with them. They might perform better because they do not need to go to two different databases.