Skip to content

SolarWinds

Clarity Transform reads observed network traffic from SolarWinds through the SolarWinds Information Service REST API, currently the NetFlow Traffic Analyzer source-to-destination flow relationships.

Where to find it

Go to Discover → Integrations, then select the SolarWinds card. The card's category label is Network. The integration's page has the Endpoints and History tabs; Integrations describes the page, its grid and its row actions.

Why we do this

Where a customer already runs SolarWinds with NetFlow Traffic Analyzer, flow data is being collected and retained today.

What we collect

  • NetFlow source-to-destination flow relationships from the NTA module
  • Endpoint addresses resolved to discovered devices, so a conversation is recorded between named machines rather than between addresses

The same endpoint extends further

The integration reads through the SolarWinds Information Service, which is also how NPM and SAM data would be reached. It is currently scoped to NTA flows; extending it needs no new credential or network path.

What it adds

Observed traffic, on an estate where the collection infrastructure already exists. Firewall policy tells you what is permitted; this tells you what actually happened, which is the pairing that makes either useful.

It can also cover parts of the network that other sources do not reach.

What is deliberately not inferred

  • No packet contents. Flow records are metadata: addresses, ports, byte and packet counts.
  • No process attribution. A flow record names endpoints, not the software at either end.
  • Nothing is written to SolarWinds.
  • Coverage equals the exporters. Traffic that never crosses a device exporting flow to SolarWinds does not appear, which includes conversations between two machines on the same segment or the same hypervisor host.

What we require

A local SolarWinds account, enabled, with read access to NTA data. No administrator rights and no write access.

  • Interface: the SolarWinds Information Service (SWIS) REST API
  • Connectivity: HTTPS on TCP 17774 from Clarity to the SolarWinds server. Installations older than 2023.1 use TCP 17778
  • Account: local to SolarWinds rather than a Windows or domain account, and enabled for API access

The port is the detail most often missed

SWIS does not listen on 443. A firewall rule raised for 443 will not reach it, and the failure looks like an unreachable server rather than a blocked port. Confirm which version is installed before raising the rule, because the port changed at 2023.1.

Verification before handover

  1. Confirm the account is enabled and can log in. A SolarWinds local account can exist and be disabled, which fails differently from a wrong password and is worth ruling out first.
  2. Confirm SWIS answers on the right port from the Clarity host. Test TCP 17774, or 17778 on an installation older than 2023.1, from the Clarity virtual machine specifically rather than from a workstation.
  3. Confirm NTA data is readable and populated. Query the NTA flow tables as the account. An empty result with a working connection usually means the account lacks NTA read, or that the retention window holds nothing.

Configuring the endpoint

On the integration's Endpoints tab, select the add icon (Create New Integration Endpoints). The Create new entry form opens with these fields, in this order:

Field Value
Name A name for the endpoint
End Point The SolarWinds server FQDN or IP address
Credential The stored credential for the local SolarWinds account
Job Schedule A five-field cron expression, for example 0 2 * * * for daily
Enabled Ticked. The box is unticked when the form opens

The help texts: End Point "FQDN or IP Address of management system for technology e.g. vCenter, Nutanix Prism"; Credential "Credentials can be configured under Settings/Identity and Access Management/Credentials."; Job Schedule "Cron schedule – Use five fields: 〈mm〉 〈hh〉 〈day-of-month〉 〈month〉 〈weekday〉".

The Credential list offers the credentials stored under Settings → Identity & Access Management → Credentials, so create the credential there first.

No field is marked as required. Technology is set by the card and is hidden in the form. Select Save to create the endpoint, or Cancel to close the form. The edit icon opens the same fields as Edit entry.

Removing the access

Disable or delete the local SolarWinds account, and remove the firewall rule for the SWIS port. Then, in Clarity, remove the endpoint (select its row on the Endpoints tab, then Remove selected) or clear its Enabled box, and remove the credential under Settings → Identity & Access Management → Credentials.

Troubleshooting

Symptom Cause
The server appears unreachable The firewall rule was raised for 443. SWIS listens on TCP 17774, or 17778 before version 2023.1.
Authentication fails The local SolarWinds account is disabled, or a Windows account was created instead of a SolarWinds one.
Connects but returns no flows The account lacks NTA read access, or SolarWinds retains no flow data for the period requested.
Flows arrive but do not resolve to devices Their addresses are not in the CMDB yet. Run the hypervisor and source integrations first, then re-run.