By configuring Sycope as a NetFlow collector in PAN-OS, organizations can use their existing Palo Alto Networks infrastructure as a source of data for continuous network monitoring and historical analysis.
The integration uses the standard NetFlow capabilities available in both systems and does not require a dedicated proprietary connector.
Table of Contents
From firewall traffic to network analysis
A NetFlow Server Profile in PAN-OS defines the collector that should receive flow records and the parameters used for export.
The profile is assigned to the interfaces whose traffic should be monitored. Palo Alto Networks supports NetFlow export from Layer 3, Layer 2, virtual wire, tap, VLAN, loopback and tunnel interfaces. The firewall processes NetFlow information for IP packets on these interfaces and exports NetFlow v9 records to the configured collector.
Once Sycope receives the records, they become part of the network data available for search, dashboards, reporting, monitoring rules and historical analysis.
This makes it possible to analyze communication observed by the firewall over time rather than limiting the investigation to the current state of an individual session.
Complementary capabilities, clearly divided
Palo Alto Networks firewalls and Sycope remain independent systems and serve different purposes within the network architecture.
Palo Alto Networks provides:
- Firewalling and traffic policy enforcement
- Network session processing
- Security inspection
- Traffic visibility at firewall interfaces
- NetFlow v9 export
- Routing and network connectivity
Sycope provides:
- NetFlow collection and analysis
- Host-to-host communication visibility
- Historical network traffic data
- Network performance analysis
- Network anomaly and threat detection
- Traffic search and filtering
- Dashboards, reporting and alerting
Palo Alto Networks controls and inspects communication as it passes through the firewall. Sycope uses the exported flow records to analyze that communication over time and together with traffic received from other network devices.
Using firewall flow data for broader network visibility
NetFlow provides a structured record of communication observed by the firewall. Collecting these records in Sycope makes them useful beyond the immediate firewall view.
Communication between systems
Flow records provide information about the endpoints involved in communication, ports, traffic volumes, timestamps and interfaces.
Sycope can use this information to show which systems communicated, when the communication took place and how much data was exchanged.
This supports analysis of connectivity issues, unexpected communication and changes in traffic patterns involving systems protected by Palo Alto Networks firewalls.
Historical traffic analysis
A current firewall event does not always provide enough context to explain what happened before an incident or performance problem.
By retaining and analyzing flow information, Sycope allows teams to return to an earlier period and review communication associated with a particular host, service or part of the network.
Historical traffic can help establish which systems communicated before an event, whether similar activity occurred previously and how network behavior changed over time.
Network performance and traffic usage
NetFlow records include traffic counters that can be used to analyze how network resources are being consumed.
Sycope can use this data to examine traffic volumes across hosts, interfaces and services and to identify systems or communication patterns responsible for significant changes in network usage.
This provides additional information for troubleshooting, capacity analysis and investigation of performance degradation.
Security analysis based on communication behavior
Firewall security controls and flow analysis provide different perspectives on network activity.
Palo Alto Networks remains responsible for enforcing security policies and inspecting traffic. Sycope analyzes communication patterns over time and can use flow information to identify anomalies and behavior that requires further investigation.
This provides NOC and SOC teams with a historical view of communication involving systems protected by the firewall and allows network detections to be assessed in a broader traffic context.
Visibility across selected firewall interfaces
PAN-OS allows a NetFlow Server Profile to be assigned to the interfaces whose traffic should be exported.
This gives administrators control over which parts of the network should contribute data to Sycope. Depending on the firewall configuration, NetFlow can be enabled on physical and logical interfaces, including VLANs, tunnels and virtual wire interfaces.
Multiple Palo Alto Networks firewalls can send NetFlow records to the same Sycope environment, allowing traffic from different network locations or security boundaries to be analyzed within a common platform.
Sycope also maintains information about individual exporters and interfaces, making it possible to distinguish and analyze traffic according to its source.
Full-flow export without sampling
Palo Alto Networks firewalls do not use sampled NetFlow. NetFlow processing is performed on IP packets crossing interfaces configured for export.
This is well aligned with Sycope deployments, where unsampled NetFlow is recommended whenever the exporting device supports it.
Using unsampled records provides a more complete representation of observed communication and avoids relying on a statistical subset of the traffic for subsequent analysis.
How the integration works
The integration consists of three main elements.
NetFlow Server Profile in PAN-OS
A NetFlow Server Profile is created on the Palo Alto Networks firewall.
The profile defines the hostname or IP address of the Sycope collector, destination port, template refresh settings and Active Timeout. PAN-OS supports up to two collectors within a single NetFlow Server Profile.
The profile is then assigned to the interfaces whose traffic should be exported.
Sycope requires an active flow timeout of 60 seconds. PAN-OS allows the Active Timeout to be configured in minutes, so a value of one minute aligns the firewall export interval with the Sycope requirement.
NetFlow collection in Sycope
Sycope receives and decodes the NetFlow v9 records exported by the firewall.
The collected data becomes available in Sycope together with flow information received from other compatible network devices.
Sycope maintains exporter and interface information alongside the flow data, allowing traffic to be analyzed according to the device and interface from which it originated.
Analysis, visualization and alerting
Once processed, Palo Alto Networks flow data can be used throughout the Sycope analytical environment.
Teams can search historical communication, build dashboards and reports, analyze traffic volumes and use monitoring rules to identify network conditions that require attention.
The firewall remains responsible for traffic enforcement and security inspection, while Sycope provides the longer-term analytical view of the communication observed by the device.
Palo Alto Networks-specific NetFlow templates
PAN-OS supports both standard NetFlow fields and enterprise-specific NetFlow templates.
The firewall selects the appropriate template according to characteristics such as IPv4 or IPv6 traffic and whether NAT is involved. Templates are periodically refreshed so the collector can correctly interpret the exported records.
PAN-OS can also include Palo Alto Networks-specific field types in NetFlow exports. The exact fields used in a Sycope deployment should be verified against the PAN-OS configuration and the data required for the monitoring use case.
From firewall sessions to historical network context
Consider a server whose communication crosses a Palo Alto Networks firewall.
The firewall processes the traffic according to its existing routing and security policies while exporting NetFlow records to Sycope.
Sycope retains and analyzes the communication over time.
If the server later becomes part of a performance or security investigation, the team can review its previous network activity, communication partners, services and traffic volumes in Sycope.
The same data can be compared with traffic collected from other exporters to provide a wider view of activity across the environment.
Palo Alto Networks continues to control and inspect traffic at the security boundary, while Sycope provides the historical network evidence required to understand how the affected systems communicated.
Palo Alto Networks and Sycope integration
Palo Alto Networks NetFlow export provides a standard way to use existing firewall infrastructure as a source of network data for Sycope.
The resulting flow information can be analyzed together with data from other network devices, providing broader visibility into communication, performance and security behavior without changing the firewall’s role in the environment.
To discuss using Palo Alto Networks flow data with Sycope, contact our team.
