Plixer’s Flow Analytics installs

We have been asked many times why the Flow Analytics module for Scrutinizer can only be installed by Plixer Technical Support engineers.

Well, it can be a simple and painless process, with the actual file download being the lengthiest step.  Or, with large networks, it can be near to a nightmare configuring the algorithms to complete in the time allotted.

We also use this time with our customers to train them on using Flow Analytics and understanding what the algorithms are reporting on and what the reported threats mean.  We walk through any threats reported and explain how to get more information to better determine if it is a bonafide threat to your network that requires pursuing, or if it is a typical behavior to be expected from a specific device.

And this is an excellent opportunity for customers to include other Network Engineers, or management, in the GoToMeeting session, and get a tour of the Flow Analytics module and an opportunity for a question and answer session.

As for the configuration of the algorithms portion, the Flow Analytics data gathering process kicks off every 5 minutes.  So that means that each and every one of the activated algorithms must complete in that time frame.  Since they run serially, one at a time, the time allowed per algorithm cannot exceed 300 seconds.

As I mentioned above, typically that is not a problem, fitting all the algorithms into a 5 minute time frame.  sometimes, however, we need to either reduce the number of routers and switches being monitored by Flow Analytics, or disable some of the less critical algorithms.  Or both.  And criticality of algorithms is based on each customer’s needs.  So it is a very specific configuration, tailored to each customer’s network and management needs.

Therefore, there are no canned instructions to email to customers to self install the module.  And with the hand-holding and training provided with our installs, we greatly reduce the support calls for install or configuration related issues.

So it’s a win-win situation for us and our customers.  Our customers get our undivided attention for up to an hour, and we reduce the incoming support requests for this product, and also reduce customer stress from a product not working optimally or not understanding the product.