3.1.10.2.30. userDeviceProfiling

The userDeviceProfiling plugin extracts information stored on ON Analytics. This information is based on the behavior of user devices on the network. The plugin queries Elasticsearch to get information about connections and traffic by a certain device.

To set up the plugin, ensure the configuration of the following fields:

../../../../_images/userdeviceprofiling.png


  • Connection protocol: ElasticSearch server connection protocol (HTTP/HTTPS).

  • ElasticSearch Server: ElasticSearch server IP address or FQDN.

  • ElasticSearch Port: ElasticSearch port.

  • ElasticSearch Index: ElasticSearch index name.

  • Check Palo Alto: It indicates if exists a Palo Alto firewall sending traffic log to Analytics.

  • Check switch info using SNMP: It indicates if the switch info retrieved by SFLOW should be checked using SNMP.

  • Enable Polycom MAC discover: It indicates if a Polycom MAC must be used. If the subject contains an SSL subject, the tag ESI_VOIP_POLYCOM will be added.

  • Automatically create CMDB Networks: It indicates if opennac auto-populates CMDB Networks and CMDB VLANs.

  • Default gateway used to create CMDB Networks: The default gateway used to create CMDB Networks. Example: [mask: 16 & network: 10.10.0.0 & Gateway: 255.254 -> Default Gateway: 10.10.255.254].

  • Mask used to create CMDB Networks: The default mask used to create CMDB Networks. Available values: [8,16,24]. Example: [userDevice IP: 10.10.36.10 & Mask: 24 -> Network: 10.10.36.0].

  • Enable client discovery: If the user device is a client, the tag UDC will be added with the corresponding service and server IP. Example: [a connection to a DNS server whose IP is 10.10.39.99 will be labeled as UDC_DNS_10.10.39.99].

  • Enable network behaviour analysis: It will assign the NBI tag to certain types of network behavior exhibited by devices. Example: a full established Internet connection will be tagged as NBI_ICD_FULL.

  • Execution TTL (m.): During this period, indicated in minutes, no more executions are done over the same client.