Ingest SflowData in Security Onion?

[luke879]

Any recommendations on ingesting SFlowData?

Better to ingest using the Logstash sflow codec (logstash-plugin install logstash-codec-sflow) or convert to Netflow using SFlowTool and the ingesting using filebeats?

Thanks for any tips!

Tom

[InfosecGoon]

If you have an easy way to convert it to Netflow, coupling that with the Filebeat module would be the first thing I would try. Security Onion doesn't really use Logstash for parsing, only as a transport.

[luke879]

Thanks Matt!