LoFP LoFP / newly deployed routers, switches, firewalls, packet brokers, collector migrations, disaster-recovery activation, exporter address changes, and integration re-onboarding can trigger this rule.

Techniques

Sample rules

First Seen Network Flow Exporter

Description

Identifies a NetFlow, IPFIX, or sFlow exporter IP that has not previously sent decoded flow records in the same data stream namespace during the prior 2 hours. This low-risk building-block signal records exporter novelty for correlation with later detection alerts in which the same address is the source of suspicious activity.

Detection logic

FROM logs-netflow.log-*, logs-goflow2.sflow-*
| WHERE observer.ip IS NOT NULL AND data_stream.namespace IS NOT NULL
| STATS
    Esql.event_count = COUNT(*),
    Esql.first_time_seen = MIN(@timestamp),
    Esql.data_stream_dataset_values = VALUES(data_stream.dataset)
  BY data_stream.namespace, observer.ip
| EVAL Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, NOW())
| WHERE Esql.recent <= 6
| KEEP
    data_stream.namespace,
    observer.ip,
    Esql.event_count,
    Esql.first_time_seen,
    Esql.data_stream_dataset_values,
    Esql.recent