Network Flows-Traffic Visibility

This chapter discusses how Secure Workload captures flows between workloads and proxy servers, providing insights into proxied traffic. The feature focuses on flow observations, which are per-minute data aggregations of unique network flows. The flow observations help identify malicious traffic and enforce security policies, additionally, allows users to filter and examine flow data. It also introduces the visibility and enforcement of defined malicious IPv4 addresses. This feature lets users identify and block traffic to these addresses using predefined filters, updated every 24 hours to help identify threats.

The chapter explains components like the Corpus Selector, Columns and Filters, and Top N Charts. These tools help users select and visualize specific datasets for detailed network flow analysis. The Corpus Selector can handle up to 2 billion flow observations. Client-Server Classification is vital for policy discovery and enforcement. It relies on accurately identifying the client and server in a flow. This process is improved with deep visibility or enforcement agents, which enhance detection accuracy. This document also covers Conversation mode, which is a simpler alternative to Detailed Mode. In Conversation mode, only conversations are reported rather than individual flows, therefore reducing computational demands. This mode is useful for segmentation tasks.

Due to recent GUI updates, some of the images or screenshots used in the user guide may not fully reflect the current design of the product. We recommend using this guide in conjunction with the latest version of the software for the most accurate visual reference.