DATA SHEETInterflowTM – Readable, searchable and actionable
records with rich context for any security data
Why Interflow
Interflow was designed by Stellar Cyber engineers with the goal
to address Goldilock dilemma of cyber security by capturing
network packets, files and logs in an effort to output a dataset thatis richer than Netflow (too little), significantly lighter weight than
PCAP (too big) and fused with context (just right) such as host name,user information, Threat Intelligence and geolocation.
Interflow starts at ingestion through the broadest suite of sensors
to literally collect all data from anything, or anywhere data andapplications reside–on the network, servers, containers, physical andvirtual hosts, on premises, in public clouds and with service providers.
Stellar Cyber provides the only comprehensive open extended
detection and response (Open-XDR) security platform providing
maximum protection of applications and data through Interflow.

Contextual Data, Actionable Results
Deep packet inspection and metadata
extraction at ingestion

Build context for the data throughnormalization, enrichment and correlation

Correlate across seemingly unrelated events

Deliver an actionable, searchable,
exportable JSON record for each event

www.stellarcyber.ai

sales@stellarcyber.aiFAMILY OF SENSORS PROVIDES
Pervasive data collection in any environment
PERVASIVE DATA INGESTIONSECURITYTOOLS LOGS

Network Sensors: collect metadata from physicalor virtual switches and aggregate logs

CONTAINER LOGSNETWORKTRAFFIC

Security Sensors: collect metadata from physical andvirtual switches as well as detect intrusions and malware

CLOUD LOGSFILES

VM LOGS

APPLICATIONSLOGSPROCESSES

COMMANDSVULNERABILITY
INFORMATIONTHREATINTELLIGENCEUSER
INFORMATIONASSETINFORMATIONGEO LOCATION

Server Sensors: collect data running on Linux andWindows servers including traffic, commands,processes, file and application information. Thesesensors operate on Windows 98 and up, Ubuntu,CoreOS, Debian and Red Hat
Container Sensors: collect data from,and operate inside Docker environments
Deception Sensors: act as honeypots within yourenvironment and operate on VMware, KVM, Hyper-V
and VirtualBox
Connectors: ensure visibility into Software-as-a-Service
applications or service provider environments including:AWS Cloudtrail, Office365, G-Suite, OKTA, vulnerability
scanners, Active Directory and SNMP
Log Forwarders: enables you to stream any logs to thesensor to be shipped to the data processor. It normalizes
and fuses the logs into interflow

Stellar Cyber operates wherever applications and data reside
including on-premises, public cloud or with service providers.

www.stellarcyber.ai

sales@stellarcyber.ai

ACTIONABLE, SEARCHABLE AND EXPORTABLE
Interflow documents ingestion, reduction, transformation, enrichment and correlation of each event.

Interflow Process

Stellar Cyber Action

Deep-packet inspection (DPI)

Stellar Cyber’s sensors transform raw data into Interflow records at ingestion and immediately start processing information.
The integrated and advanced DPI engine can identify 4,000+ network applications, extract metadata from these applications,and reassemble files. The right amount of metadata, including DNS domain names, URLs, SQL queries, etc. are extracted.
This capability leverages the distributed nature of the platform, ensuring that any pre-processing is done to ensure
performance at scale.

Reduction

Interflow reduces data overhead by removing parts of the packet / payload that are not needed to study your security
attack surface, such as video content. Data reduction from PCAP to Interflow can be up to two orders of magnitude.
The data volume is reduced while providing ample evidence for advanced detection and forensics analysis.

Transformation

Data can come from various data sources in different formats such as logs of many different firewalls. Through normalization
process, Interflow will have same format to allow the same search and the same detection to be applied to different sourceof data despite of the original format.

Correlation

Once this data is reduced and enriched, it then runs complex analytics on the dataset to identify high-fidelity breach
events. Interflow normalizes security data shared between integrated capabilities and third-party tools, driving
single-pane-of-glass visibility and control across security toolsets. Interflow’s two-staged machine learning ensuresthat seemingly unrelated or ‘normal’ events are in fact related to a complex multi-pronged attack.

Readable / Searchable

Stellar Cyber provides a workbench for security analysts – this allows them to perform simple Google-like or Boolean-logic
searches of Interflow JSON records for anything including specific users, application types and specific locations.

Exportable

Interflow records are in JSON format and are easily exported to compatible systems.

Actionable

Interflow is a human-readable JSON record that is evidence of an event without the size of full packet capture.
Interflow records can be used to trigger automatic responses directly or through SOAR integration.

www.stellarcyber.ai

sales@stellarcyber.ai