NetFlow

Purpose

The NetFlow card on Discover → Integrations opens its own page in Clarity Transform, not the endpoint page that most integrations use. The page has no header or description. It holds a Run App Inference button and a grid. NetFlow v5 capture files are uploaded through the grid's create form, then imported with the row's Run Import action.

Where to find it

Go to Discover → Integrations, then select the NetFlow card. The card's category label is Network. The card's history icon opens the standard integration page instead of this one, so open the card itself.

What you see

Actions

• Run App Inference: runs application inference over the evidence from all configured evidence sources, not only NetFlow. It is the same run as Run inference on Candidate Applications. The usual place to start inference is Run inference on Candidate Applications, which reports what the run produced for the review queues. This button reports the run as a flow and relationship summary instead (see Inference result).

Inference result

After Run App Inference, a banner next to the button reports:

• the relationships written, flows processed and observation counts updated
• the rows skipped because an endpoint did not resolve to a device, and the rows that could not be processed
• the relationships whose evidence was raised, and the listening ports derived from flows
• how many conversations had their direction established, and how many could not be resolved (that is not an all-clear)
• in red, any rows "excluded because their relationship type is not a configured evidence source". Those rows contributed nothing. Add the relationship type on Evidence Sources and run inference again.

A run where too many flows could not be processed is reported as Completed with errors: treat its results as incomplete. If a run is already going, the banner starts Already running: and gives the reason, for example "An inference job is already in progress.".

While the run is going, the banner reads "Running inference..." and the button is unavailable. If the run fails, the banner starts Error: and gives the reason; "Error: Could not contact the server." means the request did not reach Clarity. The button becomes available again after any outcome.

Import progress

Run Import shows a Progress for panel for the row, headed with the row's Name, or "Job #" and its Id when the row has no name. It reads "Waiting for updates..." until the first message arrives, then shows the import's progress messages: blue for progress, amber for warnings and red for errors. It ends with a tick when the import completes, or a warning when it completes but too many rows failed to trust the result. When the import completes, the grid reloads so Last Run and Last Result update.

If the import cannot be started, no message is shown and the panel stays at "Waiting for updates...". Select Reload table data, check the row's Last Result, and look for the reason on the Event Log.

Grid

The grid has the standard toolbar: the add icon (tooltip Create New Integrations Netflow), the edit icon, Remove selected, Clear selection, Reload table data, Enable spreadsheet editing, Export CSV and Import CSV. Each row has a Run Import action (the play icon). It is unavailable until a capture file has been uploaded to the row.

The grid remembers its Search: text, column filters, sort order and page size between visits. If the grid shows fewer rows than you expect, clear the Search: box and the filter row.

Fields

The create form (Create new entry) has one field:

• NetFlow Binary File: a file input. Help: "NetFlow v5 binary format (.nfcap, .nfcapd, .bin, .dat)". The file uploads as soon as you choose it. The form then shows Ready: and the file name, or Upload failed: and the reason. When you edit a row that already has a file, the form shows Current file: and its name.

The other fields of the record (Id, Name, Description, Last Run, Last Run By, Last Result, Temp File Location and the audit fields) are hidden in the form.

NetFlow has no endpoint form, so it has no End Point, Credential or Job Schedule field.

How to

Upload a NetFlow capture

1. Go to Discover → Integrations, then select the NetFlow card.
2. Select the add icon (Create New Integrations Netflow). The Create new entry form opens.
3. Under NetFlow Binary File, choose a NetFlow v5 binary file. Wait until the form shows Ready: and the file name. If it shows Upload failed:, read the reason and choose the file again.
4. Select Save. Saving stores the record with its file. It does not import the flows.

Import an uploaded capture

1. On the NetFlow page, find the row with the uploaded file.
2. Select Run Import (the play icon) on the row. The Progress for panel opens and shows the import's progress.
3. Wait for the panel to show the import has completed. Stay on the page while it runs.
4. Read the row's Last Result. A warning at the end of the panel means too many rows failed for the result to be trusted.

Run inference over the imported flows

Imported flows are not used until inference runs.

1. Select Run inference on Candidate Applications, or Run App Inference on the NetFlow page.
2. Read the result banner. If it reports rows excluded because their relationship type is not a configured evidence source, add that type on Evidence Sources and run inference again.

Related pages

• Integrations: the Discover → Integrations screen and its cards.
• Candidate Applications: where inference is usually run, and the first stage of application inference.
• Suggested App-to-App: app-to-app relationships, where NetFlow appears under Contributing Sources.
• Evidence Sources: which relationship types and integrations are trusted as inference evidence, and how each is weighted.
• Flow Exclusions: ports and protocols excluded from inference.
• Unknown Hosts: devices seen in traffic evidence that have no matching CMDB device record.