{"id":4714,"date":"2022-09-28T13:28:35","date_gmt":"2022-09-28T17:28:35","guid":{"rendered":"https:\/\/solutionsreview.com\/network-monitoring\/?p=4714"},"modified":"2022-09-28T13:29:44","modified_gmt":"2022-09-28T17:29:44","slug":"why-monitoring-flow-data-means-youre-only-seeing-half-the-picture","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/","title":{"rendered":"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture"},"content":{"rendered":"

\"Flow<\/p>\n

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 David Ratner of HYAS<\/a> illustrates in detail why monitoring flow data means you’re only seeing half the picture, and how you can see the forest for the trees with DNS telemetry.<\/strong><\/em><\/p>\n

\"SRThe role of visibility in detecting and addressing potential network problems (whether that be an attack or something more benign, such as a misconfiguration) is certainly not a new concept. In the past, network administrators and security teams often kept track of what was happening on their network by using data from Cisco NetFlow or one of its many third-party variations (collectively referred to as \u201cflow data\u201d in this article).<\/p>\n

However, over time, companies\u2019 operating environments have become more decentralized and expanded exponentially, introducing a big-data problem to the ingestion and monitoring of flow data. Not only is finding small anomalies within these reams of data like finding a needle in a haystack, but it can also be prohibitively expensive, as the cost of querying samples of flow data can quickly add up depending on how much data you request. In addition, companies have begun to migrate their operations to the cloud in droves. All of these developments have robbed administrators and security teams of the insight they once relied on to notice anomalies that could alert them to potential issues before they become costly problems.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

Flow Data is Only Half The Picture<\/strong><\/h2>\n
\n

In the Beginning, There Was NetFlow…<\/strong><\/h3>\n

Cisco introduced NetFlow in 1996, and initially, its chief purpose was to help network architects understand how their networks functioned. Over time, however, administrators began using it for security purposes to get a reliable record of all the IP, TCP, and UDP transactions occurring on their network, letting them identify traffic patterns across their infrastructure. NetFlow became a de facto industry standard, and other router manufacturers began including it or a variation with similar features on their products as well.<\/p>\n

Unfortunately, the technology has not been able to grow in sync with the industry. There is simply too much information being collected to effectively monitor it in a way that lets administrators stop problems in a timely fashion. Also, as mentioned before, flow data was originally a tool for network architects to understand how traffic was flowing within their networks and alert them to changes. With many companies now operating entirely in the cloud, this use case for flow data has changed \u2014 further disincentivizing teams from paying close attention to it.<\/p>\n

That said, if you ask any company if they are capturing their flow data (or at least DNS transactions), they may respond with a confident \u201cyes.\u201d But is this data actually being looked at? And if it is, how effectively is it being used? In a contemporary network environment, if you are just querying large samples of flow data, you are not getting the whole picture and spending a pretty penny. You need that canary in the coal mine that will alert you when something strange is happening and tell you exactly where it is happening.<\/p>\n

A Friend in DNS Telemetry<\/strong><\/h3>\n

This is where DNS telemetry can complete the picture. By monitoring DNS traffic, you can be alerted to anomalies in real-time. Using this information, you can then query your flow data to confirm that a transaction actually took place. If you find that no transaction took place, you can rest easy, but if it did, you now know exactly which devices were involved and who they were communicating with. To use a phone call as a metaphor: DNS monitoring lets you know a call was placed, which points you to the flow data that provides details like if someone answered the call, who they talked to, how long it lasted, etc. Essentially, DNS monitoring solves the big data problem by helping security and DevOps teams zero in on the exact transactions that raise a red flag rather than hoping to stumble over the needle in a haystack by trying to query and analyze large samples of flow data.<\/p>\n

With these two solutions working in tandem, you can respond to incidents efficiently and in real-time. This speed is vital, as you can block malicious transactions before they have had a chance to cause any real damage. Once a threat infiltrates your systems, it doesn\u2019t make itself known immediately, as it needs time to spread through the network and locate vital resources. If you can stop the attack before it enters its additional stages, you\u2019re cutting the fuse on a lit timebomb.<\/p>\n

Flow data\u2019s usefulness may have decreased in the age of big data, but when paired with DNS telemetry, it still plays a vital role in the modern security landscape. More importantly, it restores the visibility that your DevOps and security teams have been lacking to fulfill their roles effectively. By cutting through the noise, you can take a more proactive posture against cyber threats and increase your organization\u2019s overall resiliency\u2014 all while reducing your costs. But in the end, those savings are a drop in the bucket compared to the revenue you safeguard by averting a cyber-attack before it bites.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

\n","protected":false},"excerpt":{"rendered":"

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 David Ratner of HYAS illustrates in detail why monitoring flow data means you’re only seeing half the picture, and how you can see the forest for the trees with DNS telemetry. The role of visibility […]<\/p>\n","protected":false},"author":338,"featured_media":4715,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1,21],"tags":[105,1700,1638,293,84,565,1737,1777,1633,1776,588,1774,1778,1773,1587,1779,8,217,1775],"acf":[],"yoast_head":"\nWhy Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture<\/title>\n<meta name=\"description\" content=\"David Ratner of HYAS illustrates in detail why monitoring flow data means you're only seeing half the picture, and how you can see the forest for the trees with DNS telemetry.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture\" \/>\n<meta property=\"og:description\" content=\"David Ratner of HYAS illustrates in detail why monitoring flow data means you're only seeing half the picture, and how you can see the forest for the trees with DNS telemetry.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Network Monitoring Vendors, Software, Tools and Performance Solutions\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-28T17:28:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-09-28T17:29:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"David Ratner\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"David Ratner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/\",\"name\":\"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg\",\"datePublished\":\"2022-09-28T17:28:35+00:00\",\"dateModified\":\"2022-09-28T17:29:44+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/0863c43cf7aa87111a8555ef0e43a7ef\"},\"description\":\"David Ratner of HYAS illustrates in detail why monitoring flow data means you're only seeing half the picture, and how you can see the forest for the trees with DNS telemetry.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg\",\"width\":800,\"height\":400,\"caption\":\"Flow Data\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/network-monitoring\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/\",\"name\":\"Best Network Monitoring Vendors, Software, Tools and Performance Solutions\",\"description\":\"Solutions Review Network Monitoring\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/0863c43cf7aa87111a8555ef0e43a7ef\",\"name\":\"David Ratner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/519a5549066cd8a0f292ea9f45641b8c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/519a5549066cd8a0f292ea9f45641b8c?s=96&d=mm&r=g\",\"caption\":\"David Ratner\"},\"description\":\"David Ratner is the CEO of HYAS. David leads the long-term vision for HYAS and the day-to-day mission to bring confidence to HYAS clients. His career spans various areas of software and technology, from writing code for some of the first and largest mobile and messaging systems to scaling, growing, and exiting multiple venture-backed, private-equity-owned, and public software companies.\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/author\/dratner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture","description":"David Ratner of HYAS illustrates in detail why monitoring flow data means you're only seeing half the picture, and how you can see the forest for the trees with DNS telemetry.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/","og_locale":"en_US","og_type":"article","og_title":"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture","og_description":"David Ratner of HYAS illustrates in detail why monitoring flow data means you're only seeing half the picture, and how you can see the forest for the trees with DNS telemetry.","og_url":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/","og_site_name":"Best Network Monitoring Vendors, Software, Tools and Performance Solutions","article_published_time":"2022-09-28T17:28:35+00:00","article_modified_time":"2022-09-28T17:29:44+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg","type":"image\/jpeg"}],"author":"David Ratner","twitter_card":"summary_large_image","twitter_misc":{"Written by":"David Ratner","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/","url":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/","name":"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture","isPartOf":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg","datePublished":"2022-09-28T17:28:35+00:00","dateModified":"2022-09-28T17:29:44+00:00","author":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/0863c43cf7aa87111a8555ef0e43a7ef"},"description":"David Ratner of HYAS illustrates in detail why monitoring flow data means you're only seeing half the picture, and how you can see the forest for the trees with DNS telemetry.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#primaryimage","url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg","contentUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/09\/Why-Monitoring-Flow-Data-Means-Youre-Only-Seeing-Half-the-Picture.jpg","width":800,"height":400,"caption":"Flow Data"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/network-monitoring\/why-monitoring-flow-data-means-youre-only-seeing-half-the-picture\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/network-monitoring\/"},{"@type":"ListItem","position":2,"name":"Why Monitoring Flow Data Means You\u2019re Only Seeing Half the Picture"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website","url":"https:\/\/solutionsreview.com\/network-monitoring\/","name":"Best Network Monitoring Vendors, Software, Tools and Performance Solutions","description":"Solutions Review Network Monitoring","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/0863c43cf7aa87111a8555ef0e43a7ef","name":"David Ratner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/519a5549066cd8a0f292ea9f45641b8c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/519a5549066cd8a0f292ea9f45641b8c?s=96&d=mm&r=g","caption":"David Ratner"},"description":"David Ratner is the CEO of HYAS. David leads the long-term vision for HYAS and the day-to-day mission to bring confidence to HYAS clients. His career spans various areas of software and technology, from writing code for some of the first and largest mobile and messaging systems to scaling, growing, and exiting multiple venture-backed, private-equity-owned, and public software companies.","url":"https:\/\/solutionsreview.com\/network-monitoring\/author\/dratner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/4714"}],"collection":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/users\/338"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/comments?post=4714"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/4714\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media\/4715"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media?parent=4714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/categories?post=4714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/tags?post=4714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}