The NDR appliance Web UI enables you to create and manage metadata filters for your PX appliances running PX 5.0 and later.
Create custom filters by type and condition, and apply them to the L7 metadata or flow traffic captured by connected appliances in an NDR-PX configuration, a NDR-PX cluster, or a group or groups of PX appliances.
Use this page to reduce the metadata traffic sent from your Packet Capture appliance to your NDR appliance You can also enable or disable Packet Capture filters directly from the Web UI.
The table below lists the Layer 7 and flow event types you can select when you create PX metadata filters.
Event Types | ||
|---|---|---|
Layer 7 | Flow | |
ALERT | MODBUS | PXFLOWDNSAGGR |
DHCP | POP3 | PXFLOW |
DNP3 | RDP | |
DNS | RTSP | |
FILE | SIP | |
FILEINFO | SMB | |
FTP | SMB2 | |
HTTP | SSH | |
IMAP | SSH | |
IRC | TACPLUS | |
KRB5 | TLS | |