First Seen Network Flow Exporter

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

First Seen Network Flow Exporter

edit

Identifies a NetFlow, IPFIX, or sFlow exporter IP that has not previously sent decoded flow records in the same data stream namespace during the prior 2 hours. This low-risk building-block signal records exporter novelty for correlation with later detection alerts in which the same address is the source of suspicious activity.

Rule type: esql

Rule indices: None

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-125m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Network
Use Case: Network Security Monitoring
Use Case: Threat Detection
Rule Type: BBR
Data Source: NetFlow
Data Source: GoFlow2
Resources: Investigation Guide

Version: 2

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating First Seen Network Flow Exporter

This building-block rule detects a newly observed exporter identity from decoded NetFlow, IPFIX, or sFlow records. In these datasets, observer.ip identifies the exporter or sampler. The source.ip and destination.ip fields identify endpoints in the exported flow and must not be treated as the exporter transport connection.

This signal establishes novelty only. It does not prove that the exporter is unauthorized or that the exporter itself performed the activity represented by the flow records. The signal is intended for correlation with later detection alerts whose source.ip equals this alert’s observer.ip.

Possible investigation steps

Identify the device assigned to observer.ip and verify its owner, model, location, and change record.
Confirm the expected collector, data stream namespace, export protocol, observation domain, and template behavior.
Compare netflow.exporter.source_id, netflow.exporter.version, sequence values, interfaces, sampling rate, and flow volume with established exporters.
Check for template churn, malformed records, implausible addresses or byte counts, and conflicting telemetry from independent sensors.

False positive analysis

Validate recent network-device onboarding, collector migrations, disaster-recovery activation, NAT changes, and integration re-onboarding.

Response and remediation

If unauthorized, block the exporter at the collector boundary and preserve the received records for investigation.
Review collector authentication, network ACLs, and exporter configuration to prevent further telemetry injection.

Setup

edit

Setup

This rule requires at least one decoded flow-export data source:

Elastic NetFlow integration (netflow.log) for NetFlow or IPFIX records.
Elastic GoFlow2 integration (goflow2.sflow) for sFlow records processed by GoFlow2.

Verify that observer.ip contains the exporter or sampler address. Do not broaden this rule to generic firewall or network_traffic.flow events: in those records, source.ip and destination.ip describe the observed traffic and do not reliably identify the device exporting telemetry.

Rule query

edit

FROM logs-netflow.log-*, logs-goflow2.sflow-*
| WHERE observer.ip IS NOT NULL AND data_stream.namespace IS NOT NULL
| STATS
    Esql.event_count = COUNT(*),
    Esql.first_time_seen = MIN(@timestamp),
    Esql.data_stream_dataset_values = VALUES(data_stream.dataset)
  BY data_stream.namespace, observer.ip
| EVAL Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, NOW())
| WHERE Esql.recent <= 6
| KEEP
    data_stream.namespace,
    observer.ip,
    Esql.event_count,
    Esql.first_time_seen,
    Esql.data_stream_dataset_values,
    Esql.recent

« First Occurrence of User-Agent For a GitHub User First Seen Network Flow Exporter Followed by Suspicious Source Activity »