Flow overview

Axoflow uses flows to manage the routing and processing of security data. A flow applies to one or more AxoRouter instances. The Flows page lists the configured flows, and also highlights if any alerts apply to a flow.

Each flow consists of the following main elements:

• A Router selector that specifies the AxoRouter instances the flow applies to. Multiple flows can apply to a single AxoRouter instance.
• Processing steps that filter and select the messages to process, set/unset message fields, and perform different data transformation and data reduction.
• A Destination where the AxoRouter instances of the flow deliver the data. Destinations can be external destinations (for example, a SIEM), or other AxoRouter instances.

Based on the flows, Axoflow Console automatically generates and deploys the configuration of the AxoRouter instances. Click ⋮ or the name of the flow to display the details of the flow.

Filter flows

To find or display only specific flows, you can use the filter bar.

• Free Text mode searches in the following fields of the flow: Name, Destination, Description.
• AQL mode allows you to search in specific fields of the flows. It also makes more complex filtering possible, using the Equal, Contains, and Match operators. When using AQL mode, Axoflow Console autocompletes the built-in labels and field names, but doesn’t autocomplete custom labels.

Disable flow

You can disable a flow without deleting it if needed by clicking the toggle on the right of the flow name.