Docs
test1test2
6.5
6.5
  • ElastiFlow Documentation
  • Unified Flow Collector
    • General Configuration
    • Changelog
    • Maxmind GeoIP2 and GeoLite2
    • RiskIQ PassiveTotal
    • Network Interfaces
    • User-Defined Metadata
    • Docker
    • Linux
    • Unified Flow Collector Introduction
    • System Requirements
    • Supported IEs
    • AWS VPC Flow Log IEs
    • IPFIX IEs
    • Netflow IEs
    • sFlow IEs
  • Unified SNMP Collector
    • Device Groups
    • Changelog
    • Devices
    • Downloading Definitions
    • Enumerations
    • Objects
    • Object Groups
    • User-Defined Metadata
    • Docker
    • Network Interfaces
    • United SNMP Collector Introduction
    • Linux
    • Scheduling Rediscovery
  • Monitoring ElastiFlow
    • Liveness & Readiness
    • Metrics
    • Prometheus & Grafana
  • Configuration Reference
    • YAML Configuration Files
    • Configuration Reference Overview
    • Common
      • API
      • Licensing
      • Overview
      • Logging
      • HTTP output
      • Elasticsearch output
      • Kafka output
      • Monitor output
      • OpenSearch output
      • Splunk output
      • stdout output
      • Processor
    • Unified Flow Collector
      • Overview
      • Community/Conversation IDs
      • EF_PROCESSOR_ENRICH_TOTALS_IF_NO_DELTAS
      • Overview
      • RiskIQ PassiveTotal
      • Maxmind
      • User-Defined Metadata
      • Overview
      • Overview
      • User-Defined Metadata
      • Overview
      • Benchmark Input
      • Netflow/IPFIX/sFlow (UDP)
      • Licensing
      • Decoder/Processor
      • Sample Rate
      • Configuration Changes
    • Unified SNMP Collector
      • User-Defined Metadata
      • Overview
      • Licensing
      • SNMP Poller
      • EF_PROCESSOR_SNMP_ENUM_DEFINITIONS_DIRECTORY_PATH
  • API Reference
    • API Reference Overview
    • SNMP Operations
  • Data Platforms
    • Elastic
      • Basic Cluster
      • Advanced Cluster
      • Single Server
      • Multi-Tier Cluster
      • Single "Lab" Server
      • Elasticsearch
      • ElastiFlow vs. Filebeat and Logstash
      • RHEL/CentOS
      • Ubuntu/Debian
      • Kibana
      • ML
        • Network Security
        • Machine Learning
        • Availability
          • Network Availability
          • DHCP
          • LDAP
          • DNS
          • NTP
          • RADIUS
          • TCP Sessions
        • Network Security Activity
          • Rare Autonomous System
          • Network Activity
          • Rare Conversation
          • Rare Geolocation
        • Network Security Brute Force
          • Brute Force CLI Access
          • Brute Force Remote Desktop Access
          • Brute Force Attacks
        • Network Security DDoS
          • Denial-of-Service
          • ICMP Flood Attack
          • SYN Flood Attack
          • TCP DDoS Attack
          • UDP Amplification Attack
        • Network Security Recon
          • ICMP Scan
          • Reconnaissance
          • Port Scan
        • Performance
          • Unusual ASN Traffic Volume
          • Unusual Network Interface Traffic Volume
          • Network Performance
    • Opensearch
      • Dashboards
      • Auth Sig V4
    • Splunk
      • Default Search Macro
      • Configuring Data Input & Index
      • Splunk App Installation
    • Output Configuration
  • Additional Guides
    • Catalyst (sFlow)
    • FortiGate
    • hsflowd
    • Configuring Flow Sampling on Juniper Routers
    • Junos OS (sFlow)
    • MikroTik RouterOS
    • OpenWRT (softflowd)
    • Ubiquiti EdgeRouter
    • SonicWall
    • Junos OS
    • Extending SNMP Device Support
    • Flow Device Support Overview
    • SNMP Device Support Overview
    • Generating A Support Bundle
  • FAQ
    • Flows stopped showing up in Kibana (Disk(s) Full)
    • Common reasons why you have discrepancies between ElastiFlow data & reality
    • What Are Snapshots?
    • Importing the wrong dashboards (No data)
  • Knowledge Base
    • Config
      • Elasticsearch Authentication Failure
      • CA Certificate Path Incorrect
      • license/error Invalid Segments
    • Flow
      • Bidirectional Flow Support
      • Configure the UDP Input
      • Flow Records Not Received
      • Netflow v9/IPFIX Template Not Receieved
      • Unsupported sFlow Structures
    • General
      • License Has Expired
      • License Agreement Not Accepted
    • Install
      • .deb Upgrade Fails File Overwrite
    • Operation
      • Flow Collector Queues 90% Full
      • Dashboard Updates
      • Change elastiflow-* Index Name?
  • Elastic Stack Deployment
  • Download Links
Powered by GitBook
On this page
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_PORT
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_VERSION
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_COMMUNITIES
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_USERNAME
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_AUTHENTICATION_PROTOCOL
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_AUTHENTICATION_PASSPHRASE
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_PRIVACY_PROTOCOL
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_PRIVACY_PASSPHRASE
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_TIMEOUT
  • EF_PROCESSOR_ENRICH_NETIF_SNMP_RETRIES
  1. Configuration Reference
  2. Unified Flow Collector

Overview

Flow records generally include the index of ingress and egress interfaces by which the network traffic traversed the exporting device. The ElastiFlow Unified Flow Collector will attempt to determine the names, and additional attributes, of these interfaces as learned by polling the exporting device using SNMP.

EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE

This setting determines whether SNMP polls will be used to gather these network interface attributes.

  • Valid Values

    • true, false

  • Default

    • false

EF_PROCESSOR_ENRICH_NETIF_SNMP_PORT

If SNMP polling of attributes is enabled (EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE is true), this setting specifies the UDP port that is used for such polls.

  • Default

    • 161 (the default SNMP port number)

EF_PROCESSOR_ENRICH_NETIF_SNMP_VERSION

If SNMP polling of attributes is enabled (EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE is true), this setting specifies the SNMP version that is used for such polls.

:::info All network devices which may be polled MUST support this version of SNMP. :::

  • Valid Values

    • 1 - use SNMPv1

    • 2 - use SNMPv2c

    • 3 - use SNMPv3

  • Default

    • 2

EF_PROCESSOR_ENRICH_NETIF_SNMP_COMMUNITIES

If SNMP polling of attributes is enabled (EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE is true), this setting specifies the SNMP community strings that may be used for such polls. If a comma-separated list is specified, the collector will try each community in the order specified. Once a community returns a successful response the collector will remember this community for future polls of the device.

:::info All network devices which may be polled MUST be configured to all visibility of collected attributes using this community. It may be necessary to specify a view associated with this community. The documentation for your devices should contain the necessary information that you will need for determining the correct configuration steps. :::

  • Example

    • public,private,whatever

  • Default

    • public

EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_USERNAME

The username used to authenticate with the device using SNMPv3.

  • Default

    • ''

EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_AUTHENTICATION_PROTOCOL

The authentication protocol used to authenticate the username with the device using SNMPv3.

  • Valid Values

    • noauth, md5, sha, sha224, sha256, sha384, sha512

  • Default

    • noauth

EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_AUTHENTICATION_PASSPHRASE

The authentication passphrase used to authenticate the username with the device using SNMPv3.

  • Default

    • ''

EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_PRIVACY_PROTOCOL

The privacy protocol used to encrypt SNMPv3 traffic between the SNMP input and the device.

  • Valid Values

    • nopriv, des, aes, aes192, aes256, aes192c, aes256c

  • Default

    • nopriv

EF_PROCESSOR_ENRICH_NETIF_SNMP_V3_PRIVACY_PASSPHRASE

The privacy passphrase used to encrypt SNMPv3 traffic between the SNMP input and the device.

  • Default

    • ''

EF_PROCESSOR_ENRICH_NETIF_SNMP_TIMEOUT

If SNMP polling of attributes is enabled (EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE is true), this setting specifies the number of seconds to wait for the polled device to respond.

  • Default

    • 2

EF_PROCESSOR_ENRICH_NETIF_SNMP_RETRIES

If SNMP polling of attributes is enabled (EF_PROCESSOR_ENRICH_NETIF_SNMP_ENABLE is true), this setting specifies the number of retries to attempt after the initial poll has timed out or otherwise fail. The timeout period will be doubled for each retry.

  • Default

    • 1

PreviousOverviewNextUser-Defined Metadata