Data Source: GoFlow2 | Detection.FYI

First Seen Network Flow Exporter Followed by Suspicious Source Activity

Sep 19, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Defense Evasion Rule Type: Higher-Order Rule Data Source: Elastic Security Data Source: NetFlow Data Source: GoFlow2 Resources: Investigation Guide Rule Type: ES|QL ·
Share on:

Identifies a newly observed NetFlow, IPFIX, or sFlow exporter IP followed by another detection alert with medium-or-higher severity or an elevated risk score, where that exporter IP is the source of the detected activity in the same data stream namespace. This correlation adds behavioral evidence that can help distinguish routine exporter onboarding from a potentially unauthorized or compromised exporter introduced as part of defense evasion.

Read More