Differences

This shows you the differences between two versions of the page.

--- tips:paloalto [2019/11/01 17:21] – [New Counter Groups : User-ID and App-ID] veera
+++ tips:paloalto [2019/11/01 18:25] (current) – [NAT issues] veera
@@ Line 27: / Line 27: @@
+To view these metrics
+  * **Use Retro Analysis** : Select //Retro > Retro Counters// then select a time frame, then select User-ID from the list of counters shown on the right side.  You can see the top items for each metric.
+  * **Create dashboards** : Customize > UI >Dashboards > Create a new dashboard. Give it a name. Then Press the + button to add a new module.   Clone "Current Top Hosts" of type "current toppers in a list". Then edit to module to change to User-ID and Metric 0.
+The retro analysis screen looks like below.
+{{:tips:retro.png?600|}}
+The Retro Analysis tools show you the Top-N, Bottom-N, Topper Trend over time, and Pie chart views. The following chart shows you toppers over time.
+{{:tips:retro2.png?600|}}
+==== NAT issues ====
+The default behaviour is to show the Internal and External IP addresses. The NAT is hidden from Trisul , if you wish to see the NAT'd firewall address set the  following parameter to FALSE in the [[https://www.trisul.org/docs/ref/netflow-config.html|Netflow configuration file]]
+<code>
+        <UsePostNATAddresses>False</UsePostNATAddresses>
+</code>
+==== Query by user-id and app-id ====
+The next step is to create a [[https://www.trisul.org/docs/ug/tools/flow_tagger.html|flow tagger]] that adds the User-ID and App-ID to every flow stored in Trisul.
+Login as admin, then go to profile0 > Flow Taggers > Create a new Flow Tagger.  Then create an AUTO:userid  flow tagger (see docs) to add the User-ID counter group keys to the flow. Use a Tagger Group of ''user'' as shown below
+{{:tips:flow-tag-create.png?400|}}
+Do the same for App-ID.  Now restart Trisul. From this point every flow will be tagged by the User-ID and App-ID.
+=== Query flows ===
+//From Tools > Explore Flows//
+Use the syntax ''tag=[user]red\mike''  to query for flows from user ''red\mike''
+or ''tag=[app]whatsapp-base'' to query whatsapp flows.
+You can see the flow tags.
+{{:tips:flowtag1.png?400|}}
+=== Aggregate flows  ===
+//From Tools > Aggregate Flows//
+Use ''tag=[user]red\mike''  to aggregate for flows from user ''red\mike''
+This shows top IPs, top Applications, and other aggregated information for the user. A complete picture.
+A sample is shown below.
+{{:tips:aggflows1.png?400|}}
+==== Conclusion ====
+User-ID and App-ID attributes open up very powerful possibilities for visibility and investigation. Using the flexible tools offered by the Trisul platform you can customize in a variety of ways. Other tools you can use are "Filtered Counter Groups" if you want to zoom in on a particular user or app,  "Cross keys" to monitor User App dataflows, "Flow Trackers" to zoom in on top flows from a particular user, etc. The scripting API also offers unlimited ways to craft your own tooling.
-NAT issues
-Create flow tags
-Create dashboards
-Query by user-id and app-id
-Aggregate flows
-Crosskeys