Artikler
From raw NetFlow to clean OCSF Network Acitivity
arrow_backTil oversigten7. august 2026 | Tenzir GmbH
Network flow data gives security teams broad visibility without requiring them to retain packets. It is also awkward security data. NetFlow v5 uses a fixed record layout, while NetFlow v9 and IPFIX depend on exporter-specific templates. Vendors add their own information elements, and a field called source does not necessarily prove which endpoint initiated a connection.
A useful pipeline has to do more than turn bytes into fields. It has to keep exporter state, preserve vendor detail, and make semantic uncertainty explicit. It also needs to produce a stable event contract that downstream systems can use without knowing which flow protocol or exporter created the record.
This post follows that path: binary datagrams in, one OCSF Network Activity contract out.
Artikel er skrevet af:
Tenzir GmbH
I en verden, hvor sikkerhedsdata ofte er låst fast bag stive platforme, skyhøje udgifter og proprietære formater, tror vi på en anden fremtid – en fremtid, hvor data flyder frit uden begrænsninger.
Sikkerhedsdata bør være et strategisk aktiv, ikke en byrde styret af leverandører. Enhver organisation fortjener kraftfulde, intuitive værktøjer, der gør sikkerhedsdata tilgængelige, oplysende og handlingsrettede – uden besvær med kompleksitet, siloer eller uforudsigelige omkostninger.
Vi er her for at omdefinere, hvordan sikkerhedsteams behandler, analyserer og handler på baggrund af deres da