Skip to main content
Version: 7.0

Changelog

Release History

7.0.0

Updates

  • Product Naming - The ElastiFlow Unified Flow Collector is now called NetObserv Flow
  • Product Naming - The ElastiFlow Unified SNMP Collector is now called NetObserv SNMP
  • Product Naming - For anything that applies to both flow and snmp, we will simply refer to NetObserv

New Features

  • NetIntel Threat Intelligence - NetObserv now uses ElastiFlow NetIntel for populating the information on the Threats dashboard.
  • NetIntel Online Application and Cloud Service Identity - NetObserv now uses ElastiFlow NetIntel to enrich public IP addresses with online application and Cloud Serivce Identity information on the Top-N -> Apps dashboard.
  • AWS VPC Flow Logs - Added support for S3 buckets using data sent from Amazon Firehose, as well as custom log formats when using Firehose data. For more information about configuring this, please see AWS VPC Flow logs.
  • User-defined mapping for IPs used for SNMP polling - Allows users to poll SNMP info for a device on a different IP address than it sends flow records from.

Breaking Changes

Click here for more information and all steps you need to take to upgrade from 6.x to 7.x

  • RiskIQ EoL - Since RiskIQ will reach its end of life on June 30th 2024, NetObserv v7 will no longer support threat enrichment through RiskIQ. NetIntel threat enrichment will replace RiskIQ and is enabled by default.
  • Licensing - The NetObserv basic license now supports all 7400+ vendor specific flow fields (previously only supported 1020 fields). The community license has been downgraded to only support 500 flows per second per organization (previous limits was 4000 fps). If you are using a community license and need a higher flow rate, please use this form to sign up for a free 1 year basic license.
  • AWS VPC Flow logs - To set us up to deliver more flexible ways to retrieve flow logs (e.g. through Firehose) we needed to make some changes to the config fields for AWS VPC flow log enrichment. You need to change your configuration options to the new format to ensure you continue to receive VPC flow logs.