ElastiFlow NetIntel

In order to enable NetIntel enrichment, you need to be on version 7.x of NetObserv Flow (flowcoll) and on Elasticsearch 8.x or OpenSearch 2.x. You will also need to download and install the latest Kibana Dashboards or OpenSearch Dashboards respectively.

Overview

ElastiFlow NetObserv Flow provides the ability to enrich flow records with threat intelligence and app/service information provided by ElastiFlow's NetIntel feed. NetIntel can help you quickly identify threats and high-risk traffic in your environment.

Configurations

EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_ENABLE

Enrichment with NetIntel is enabled by default starting in NetObserv v7. If you don't want NetIntel enrichment set this option to false.

• Valid Values

  • true, false

• Default

  • true

EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_AS_PREFIX_PRECISION

It's possible for an Autonomous system to house other Autonomous systems. Therefore, a user can either get the most specific AS prefix or all the prefixes for all the Autonomous systems a packet went through.

• Valid Values

  • all, exact

• Default Value

  • exact

Air-Gapped Environment Configurations

By default, the NetIntel dataset is retrieved via API requests and stored to the Data Path directory for enrichment purposes. If you want to use NetIntel enrichment in an air-gapped environment, download the dataset and specify the path to it.

This feature is only available to standard or premium licensed customers.

EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_THREAT_COLLECTION_PATH

Path for the downloaded Threat Collection dataset. Setting this configuration option to non-empty string disables the recurring retrieval of the Threat Collection dataset.

• Default

  • ''

• Recommended

  • /etc/elastiflow/netintel/threat_collection.pb

EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_IP_DB_PATH

Path for the downloaded IPDB dataset. Setting this configuration option to non-empty string disables the recurring retrieval of the IPDB dataset.

• Default

  • ''

• Recommended

  • /etc/elastiflow/netintel/ipdb.pb

Downloading the dataset

Installing `netobserv` CLI Tool

You can download and install the netobserv CLI tool on Linux machines via our deb or rpm packages.

deb:

wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/netobserv/netobserv_7.24.0_linux_amd64.deb
sudo apt install ./netobserv_7.24.0_linux_amd64.deb

rpm:

wget https://elastiflow-releases.s3.us-east-2.amazonaws.com/netobserv/netobserv-7.24.0-1.x86_64.rpm
sudo yum install -y netobserv-7.24.0-1.x86_64.rpm

If upgrading from a previously installed rpm, run the following:

sudo rpm -Uhv netobserv-7.24.0-1.x86_64.rpm

Download the Dataset

To download the NetIntel dataset, use the following command:

EF_ACCOUNT_ID="{your account id}"
EF_LICENSE_KEY="{your license key}"
EF_LICENSE_ACCEPTED="true"
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_IP_DB_PATH=/etc/elastiflow/netintel/ipdb.pb \                                 
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_THREAT_COLLECTION_PATH=/etc/elastiflow/netintel/threat_collection.pb \
/usr/share/elastiflow/bin/netobserv pull dataset --source=netintel --config={path to flowcoll.yml}

Or, alternatively,

EF_ACCOUNT_ID="{your account id}" \
EF_LICENSE_KEY="{your license key}" \
EF_LICENSE_ACCEPTED="true" \
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_IP_DB_PATH=/etc/elastiflow/netintel/ipdb.pb \                                 
EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_THREAT_COLLECTION_PATH=/etc/elastiflow/netintel/threat_collection.pb \
/usr/share/elastiflow/bin/netobserv pull dataset --source=netintel

You must have permission to write to the download paths (/etc/elastiflow/netintel is the default)

Then, provide the path to the dataset files in the NetObserv Flow configuration by setting the EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_THREAT_COLLECTION_PATH and EF_PROCESSOR_ENRICH_IPADDR_NETINTEL_IP_DB_PATH respectively.