MENU
How does a SOC leverage flow collectors?
A flow collector (such as Cisco Secure Network Analytics, formerly Stealthwatch) is a critical tool within a Security Operations Center (SOC) for providing 'pervasive visibility' into the network. Instead of capturing every full packet---which is resource-intensive---a flow collector ingests NetFlow or IPFIX data, which contains metadata like source/destination IPs, ports, and the volume of data transferred.
The SOC leverages this data for threat detection and response by establishing a baseline of normal network behavior. When a flow collector identifies an anomaly---such as an endpoint suddenly sending gigabytes of data to an unusual external IP (data exfiltration) or scanning internal ports (lateral movement)---it flags the incident for analysis. Unlike Real-time content filtering (Option D), which happens at the gateway (e.g., Cisco Umbrella or WSA), flow collectors provide a historical record and behavioral analysis of all internal and external traffic. They do not perform load balancing (Option B) or backup/recovery (Option A). In the Cisco SDSI framework, flow analysis is essential for identifying the 'unknown unknowns' and providing the forensic evidence needed to understand the scope and path of a security breach.