Flowmon Collector
Centralises, organises and analyses flow telemetry to build network visibility.
PROGRESS FLOWMON
Network visibility to understand performance, behaviour and risk.
Add Solution uses Progress Flowmon to turn network telemetry into operational visibility, performance analysis, anomaly detection and incident investigation.
Using flow data, behavioural analysis and intelligent packet capture, we build a view that explains how the network behaves, where degradation occurs and which events need attention.
NETWORK VISIBILITY
The network should not be a black box between users and applications.
Availability alone does not explain slowness, unexpected usage, dependencies or behavioural changes. Network telemetry reveals who communicates with whom, when, for how long and in what volume.
- TELEMETRIA
Flows and metadata generated by the infrastructure.
- CONTEXTO
Conversations, services, applications and dependencies.
- COMPORTAMENTO
Relevant patterns, deviations and changes.
- ACTION
Evidence-led investigation.
Monitoring status shows whether something is available. Observing flows helps explain what is happening.
FLOWMON PLATFORM
One platform, different levels of detail.
The Flowmon architecture combines telemetry collection and generation with modules for visibility, performance, behaviour, security and investigation. The configuration is defined according to the environment and expected outcome.
Flowmon Probe
Generates flow data from traffic when the infrastructure does not provide the required telemetry.
Anomaly Detection System
Analyses behaviour and deviations to support threat detection and investigation.
Flowmon Packet Investigator
Triggers on-demand or event-driven packet captures and automates PCAP analysis.
Application Performance Monitor
Passively observes applications at the network level to support experience and performance analysis.
FLOW TELEMETRY
Turn traffic into information without guesswork.
Flowmon receives telemetry such as NetFlow, IPFIX, sFlow, jFlow and NetStream, as well as data generated by probes and cloud sources. Add Solution defines exporters, observation points, retention and sizing so that visibility reflects the actual environment.
- NETWORK / CLOUD
Routers, switches, firewalls, virtual environments and cloud.
- FLOW DATA
NetFlow, IPFIX, sFlow, jFlow, NetStream and equivalent sources.
- FLOWMON
Collection, analysis, correlation and context.
- OPERAÇÃO
Performance, capacity, security and investigation.
FLOW + PACKET
Flows show where to investigate. Packets explain the details.
Flow data provides efficient coverage and retention for observing conversations and trends. When an investigation requires greater depth, packet capture provides detailed evidence. The two approaches complement each other rather than compete.
Breadth and history
A continuous view of communication, volume, patterns and trends.
Investigative depth
Packet-level detail for events that require precise diagnosis.
Targeted capture
Context helps capture what matters at the right time.
ENGENHARIA ADD SOLUTION
Analysis quality starts with the collection architecture.
Before dashboards, we assess topology, volumes, observation points, asymmetry, encapsulation, retention and operational questions. A platform only produces reliable answers when it receives the right data and is sized to interpret it.
What needs to be observed?
Services, segments, data centres, branches, cloud and critical links.
Where does the telemetry originate?
Exporters, probes, aggregation points and available sources.
How much history is needed?
A policy aligned with investigation, trends, capacity and cost.
Who will use the information?
Network, infrastructure, application, security and management teams.
We do not start with the screen. We start with the questions operations need answered.
PERFORMANCE & CAPACITY
From symptom to cause with network context.
Flow visibility helps distinguish network, application, usage and capacity problems. Volume trends, top conversations, perceived latency and changing patterns support troubleshooting and planning without turning every analysis into a manual search.
Investigate degradation
Locate conversations, segments and services associated with the impact.
Understand expected behaviour
Compare the current situation with relevant patterns and historical data.
Plan with evidence
Observe trends, utilisation and growth before saturation.
APPLICATION PERFORMANCE MONITOR
Applications observed through the network experience.
Flowmon APM uses passive network-level analysis to observe communication between users, applications and databases. This approach complements other observability and tracing practices; it is not intended to replace every form of application instrumentation.
- USER
The request arrives over the network.
- NETWORK
Communication timing and behaviour.
- APPLICATION
Response from the observed service.
- DATABASE
Dependencies that influence the experience.
NDR & BEHAVIOUR ANALYTICS
Network behaviour as a source for detection and investigation.
Flowmon ADS analyses communication patterns and anomalies to highlight behaviours that warrant investigation. Techniques associated with MITRE ATT&CK help organise the context, while integrations can route events to security processes and platforms.
Deviations and anomalies
Behavioural changes analysed in the context of the network.
Context for investigation
Linking events to techniques to support analysis and prioritisation.
Events connected to operations
Syslog, SNMP, email, REST and scripts, according to the architecture.
NDR extends network visibility. It does not remove the need for endpoint, identity, perimeter and response controls.
PACKET INVESTIGATOR
From anomaly to packet evidence.
Flowmon Packet Investigator can initiate on-demand or event-driven captures and perform automated analysis of PCAP files. Investigations gain depth without indiscriminate full capture of all traffic.
- EVENTO
A behaviour requires analysis.
- CAPTURA
Relevant packets are collected.
- PCAP
Evidence is preserved for investigation.
- ANALYSIS
Protocols and events are examined.
- DECISION
The team acts with more context.
ECOSSISTEMA OPERACIONAL
Visibility is more valuable when it reaches the right teams and processes.
Events and data can integrate with tools and workflows through syslog, SNMP, email, REST and scripts. In a broader architecture, Fortinet contributes security controls and telemetry, Zabbix provides infrastructure monitoring and Lansweeper adds asset context—relationships designed for each environment, without assuming mandatory integration.
- FLOWMON
Flows, behaviour, performance and investigation.
- FORTINET
Network security controls and context.
- ZABBIX
Infrastructure availability, metrics and events.
- LANSWEEPER
Asset inventory and context.
- OPERAÇÃO
Data converges to support decisions and response.
FLOWMON PROFESSIONAL SERVICES
From network assessment to continuous platform improvement.
Add Solution combines expertise in networking, infrastructure, observability and security to deploy Flowmon around the actual questions operations need answered.
- ASSESSMENT
- ARCHITECTURE
- SIZING
- IMPLEMENTATION
- TELEMETRY
- TUNING
- INTEGRATION
- ENABLEMENT
- EVOLUTION
NETWORK VISIBILITY ASSESSMENT
Your network produces data. Is it answering the right questions?
Add Solution can assess telemetry sources, coverage, retention, sizing and use cases to build a visibility strategy aligned with operations.
POR QUE ADD SOLUTION
The tool collects telemetry. Engineering turns data into operational capability.
Our work connects network architecture, data quality, use cases and processes so that the platform is useful in day-to-day operations and at critical moments.
Knowledge of the observed infrastructure
The analysis considers topology, protocols, links, segmentation and dependencies.
Data driven by questions
Use cases defined before dashboards and alerts.
Performance and risk in the same context
A multidisciplinary view of events spanning multiple domains.
Information connected to operations
Architecture aligned with existing workflows, tools and responsibilities.
PERGUNTAS FREQUENTES
Perguntas frequentes
Clear answers about Flowmon telemetry, modules, retention, recovery and operations.
Does Collector need a Probe in every project?
Not necessarily. Compatible equipment can export flows. A Probe is considered when the data, coverage or attributes required by the use case are missing. Source: architecture (https://docs.progress.com/bundle/progress-flowmon-os-13-0/page/topics/user-guide/Introduction.html).
Do NetFlow, IPFIX and sFlow offer the same detection capabilities?
No. Quality, sampling and attributes matter. ADS does not recommend sFlow for its methods because of data limitations. Source: ADS requirements (https://docs.progress.com/bundle/progress-flowmon-ads-quick-start-guide/page/topics/quick-start-guide/Requirements.html).
Do flows store every packet?
No. Flow records are summaries and metadata. PCAP capture requires dedicated resources and a defined storage scope, such as those assessed for Packet Investigator. Source: FPI (https://www.progress.com/flowmon/platform/software-modules/packet-investigator).
Does Flowmon decrypt all HTTPS communication?
No. Visibility depends on the protocol, observation point and technical conditions. Encrypted traffic metadata does not mean unrestricted access to the content. Source: APM conditions (https://docs.progress.com/bundle/progress-flowmon-apm-13-0/page/topics/apm-user-guide/Servers.html).
Are ADS and APM included in every licence?
This should not be assumed. The proposal must confirm modules, models, compatibility and the term of the contracted rights. Source: licence (https://docs.progress.com/bundle/progress-flowmon-os-13-0/page/topics/user-guide/License.html).
How much history is available?
It depends on the collected volume and allocated space. Actual retention must be monitored through quotas and validated under a representative load. Source: Resource Manager (https://docs.progress.com/bundle/progress-flowmon-os-13-0/page/topics/user-guide/Resource-Manager.html).
Does the standard backup protect every module?
No. The documented mechanism has exclusions, including ADS and APM. Recovery must be planned and tested for each component. Source: disaster recovery backup (https://docs.progress.com/bundle/progress-flowmon-os-13-0/page/topics/user-guide/Backup-for-Disaster-Recovery.html).
Does Flowmon replace infrastructure monitoring?
The approaches can complement each other. Server and equipment health, communications and security signals answer different questions. The design should define coverage and responsibilities. Source: platform monitoring (https://docs.progress.com/bundle/progress-flowmon-os-13-0/page/topics/user-guide/Recommended-Post-Installation-Steps.html). <!-- FIM_TEXTO_EDITORIAL -->
SOLUÇÕES RELACIONADAS
Observabilidade conectada à operação.
ADD SOLUTION + PROGRESS FLOWMON
Turn network telemetry into better decisions.
Talk to our specialists about visibility, performance, NDR, investigation and Progress Flowmon architecture.