NetFlow analytics and flow intelligence

NetFlow is necessary. Context is the product.

Flow exporters already tell you who talked to whom, how much traffic moved, and which interfaces were involved. Operators still end up opening other tools to answer the questions that matter: which process or container, which Kubernetes workload, which site or role, which AS path, and whether the peer is on a threat feed.

ServiceRadar collects flow telemetry and attaches that context onto the same conversation, so traffic maps and investigations start with answers instead of another round of pivot work.

Collect flow telemetry from the devices you already trust

Point routers, switches, and firewalls at ServiceRadar and keep using the export formats your network already supports: NetFlow, IPFIX, and sFlow. Multi-vendor fleets stay coherent even when many devices send data at once.

• See traffic matrices, top talkers, and destination patterns without a separate flow silo
• Keep dashboards and queries next to the rest of your operational picture
• Scale with the exporters you have today, including high-volume edges on Enterprise hosted footprints when Cloud is available

Setup detail lives in the NetFlow docs when you are ready to export.

Attribute flows to processes, containers, and Kubernetes workloads

NetFlow alone stops at the host. ServiceRadar goes further by tying conversations to what actually owned the traffic on that host.

Those layers stay independent on purpose. You can attribute processes without running Kubernetes, and you can inventory workloads without collecting every packet. When both are enabled, they join with NetFlow so one conversation can carry host and workload identity together.

Deeper deployment guidance: host network visibility and workload identity.

Tag IPs and CIDR blocks the way modern flow platforms do

Flow records are full of addresses. Without labels, every investigation turns into “what is this subnet again?” Prefix tags attach business meaning to IPs and CIDRs so traffic can be filtered and explained in the language of your network: site, role, tenant, zone, and more.

When a more specific range and a broader range both match the same address, the most specific label should win. ServiceRadar applies that longest-prefix match as flows arrive, so each conversation picks up tags from the best-matching prefix without a separate post-processing step.

Bring tags from IPAM, not from memory

The best source of prefix meaning is usually the system that already owns address planning. ServiceRadar integrates with IPAM so tags follow the source of truth instead of living only inside the monitoring product.

Once tags are on the flow, investigations stop sounding like raw addresses and start sounding like operations: guest Wi-Fi at Austin, management ranges, a tenant block, or a cloud provider prefix. That is the difference between a flow collector and a network intelligence surface.

For configuration detail, see prefix tags in the product docs.

Enrich flows with ASN, prefixes, and geography

Internet-facing investigations need more than private CIDR labels. ServiceRadar adds routing and geography onto the same flow rows you already use for top talkers and path analysis.

Combined with prefix tags, a single flow can answer both “this is guest Wi-Fi at Austin” and “the peer is a well-known public network in another region,” which is what makes traffic maps useful under pressure.

Correlate flows with threat-intelligence IOCs

Flow analytics get sharper when endpoints can be checked against current threat intelligence without exporting every conversation to a separate system first. ServiceRadar can highlight source and destination IPs that match IOCs from your feeds, so investigations start with better leads.

• Spot conversations involving known-bad or high-interest peers while reviewing traffic
• Keep severity and feed labels next to the flow for faster triage
• Treat matches as investigation leads, not automatic containment decisions

One conversation, more than a 5-tuple

ServiceRadar is designed so flow volume, process and workload identity, business tags, internet context, and threat leads land on the same story. You do not have to rebuild that join every time an incident starts.

Investigate with SRQL, the ServiceRadar Query Language

Collecting and enriching flows only helps if people can ask questions quickly. SRQL is a compact, readable query language built into ServiceRadar for searching network data in the product UI. You do not need SQL to start: describe what you want, filter by time and context, and refine from there.

For flow investigations, that means one place to move from volume and top talkers into prefix tags, destinations, attributed workloads, and threat-intel leads without exporting CSVs between tools.