Netflow Support in 2.4

[Xboarder56]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

32

Storage for /

1000

Storage for /nsm

1000

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

I'm trying to enable netflow for Security onion 2.4. The previous documentation for 2.3 covered this and Security Onion Solutions released their own youtube video on this but it appears to be different on 2.4. Can we get some input on the best way to enable this on the newer version release?

Previous Guides:

• https://docs.securityonion.net/en/2.3/filebeat.html?highlight=netflow#walkthrough-netflow-logs

I believe I'll need to enable the integration on the grid in fleet via the agent policies (so-grid-nodes_general?) as step one and then add a firewall rule under the config in SOC for inbound on the netflow port?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[Xboarder56]

Ended up being exactly as described with some tweaking needed on the firewall rules to allow netflow in.