cancel
Showing results for 
Search instead for 
Did you mean: 

What kind of network flow does McAfee SIEM support?

Jump to solution

What kind of network flow does McAfee SIEM support?

Refer to device support list I got from local SE (last update on November 2012), McAfee SIEM support following network flow:

  • Netflow (using NitroFlow NetFlow Collector)
  • Citrix AppFlow (it said "custom" but I have no idea what's the customization required?)
  • IP Fix (again "custom" what kind of custom needed?)
  • sFlow (using NitroFlow NetFlow Collector)

Here are my questions

  1. How about Juniper J-Flow & rFlow? Does McAfee SIEM support them?
  2. Are there any limitations regarding network flow collecting? e.g. licensing, performance or even need dedicated port on receiver.
  3. Does one flow count as 1 EPS?

Best regards,

Parinya

1 Solution

Accepted Solutions

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Parinya,

IPFIX and Appflow are both code based parsers which is what is meant by custom. These will work out of the box with McAfee ESM 9.0 and above. Also, please note there is a more up to date device list that I issued this month. It typically takes a few weeks for the website to be updated. What SE did you work with to obtain the list? I will have him/her provide it to you.

Brian

View solution in original post

9 Replies
McAfee Employee siemchris
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Hi Parinya

For the question regarding IPFix and Citrix AppFlow I see from the documentation that we do currently support IPFIX. I would recommend a PER if you need Citrix AppFlow. We also supoprt Generic Netflow v5 v7 v9 and sFlow v5.

We do not currently support j-Flow or rFlow. A PER is the best option if you need support for them - https://mcafee.acceptondemand.com/index.jsp

For licensing questions I would check with your SE as they are the best people for that information. You do need to configure a port on the interface for the flows as shown below.

I assume you are asking if one flow counts as 1 EPS so you can do some capacity planning? I dont have that information handy but I will see what I can find.

Chris

FlowPorts.JPG

McAfee Employee siemchris
McAfee Employee
Report Inappropriate Content
Message 3 of 10

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Hi Parinya

As an update, when the router or switch sends the flow information to us each flow record will count as one EPS.

Regards


Chris

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Hi Chris,

Thank you very much. For information.

For IPFIX & AppFlow, I saw them in the "McAfee SIEM Vendor Device Support_Nov_2012" got from local SE. I think it's quite up-to-date more than one available on the McAfee web site. Nevertheless, those ones are stated as "Custom" in parser field. So I don't what kind of customation needed.

Regards,

Parinya

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Parinya,

IPFIX and Appflow are both code based parsers which is what is meant by custom. These will work out of the box with McAfee ESM 9.0 and above. Also, please note there is a more up to date device list that I issued this month. It typically takes a few weeks for the website to be updated. What SE did you work with to obtain the list? I will have him/her provide it to you.

Brian

View solution in original post

Highlighted

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Dear Brian,

Thank you very much for useful information.

I'm work closely with following Nithipat N., Sutee C. and Puriwat S.

I think they got document from Mark, Singapore SE.

Best regards,

Parinya

bperez
Level 10
Report Inappropriate Content
Message 7 of 10

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Im trying to send netflow traffic from Vmware VSwitches, but i dont see any flow in the receiver data source, is compatible with Vmware Netflow?

Regards!

Bernardo.

mmuz
Level 7
Report Inappropriate Content
Message 8 of 10

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Bernardo, SIEM supports Netflow v 5, 7 and 9. From what I've found VMware exports in v5, so it should work fine assuming proper configuration on both ends. Are you aware that flows are only visible in 'Flow views', not in most other predefined dashboards?

Regards,

Marcin

bperez
Level 10
Report Inappropriate Content
Message 9 of 10

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Hi Marcin,

Thanks for you response, i have one data collector of type Netflow, and i see traffic from the virtual switch, but i dont see any traffic in graphs:

The Data Collector IP is: 192.168.201.218

The Vswitch IP is: 192.168.201.219

Netflow port is: 9993

netflow data source.png

vswitch netflow.png

tcpdump.png

dashboard.png

Any Suggestion?

Regards!

El mensaje fue editado por: bperez on 16/12/13 10:22:36 AM CST
mmuz
Level 7
Report Inappropriate Content
Message 10 of 10

Re: What kind of network flow does McAfee SIEM support?

Jump to solution

Bernardo,

In netflow data source's properties - you should set 192.168.201.219 as it's address. The Receiver's firewall drops all the packets, as the source's IP is set improperly. You can verify it:

iptables -nvL

I hope it helps

Regards,

Marcin

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community