Since I wrote my last blog on FireSIGHT integration, a lot has changed with Scrutinizer. We have a new WebUI, new reports, and our FireSIGHT integration now works differently. This, of course, means that the way we set up the integration is a bit different as well.
Recently I was visiting a customer on site when they mentioned they felt like they were not getting accurate information from their Cisco Catalyst 4510. Upon investigation, their flow record, monitor, and exporter all looked correct. Puzzled, my colleague and I took a look at Cisco’s website and found some interesting information regarding the configuration.