Sflow vs Netflow, how do I configure in RSA log appliance?

[RSAAdmin]

We have over 80% of Brocade switches.  I want to configure sflow in our RSA logging appliance.  How do I do this?  I only see netflow being supported.  Thanks

[Anonymous]

Hi Daniel,

sFlow is not supported and is currently not on the roadmap.

sFlow is sampled, and while very useful for traffic monitoring performance use cases, it isn't ideal for the security use cases that we are trying to address in Security Analytics.  If it is only sending 1 in 10 or 1 in 100 entries, there is a very good chance we would miss a malicious connection.

With Netflow we can address cases such as a development machine accessing a finance server or tracking the lateral movement of a threat on the internal network.  We wouldn't be able to address these using sFlow

Thanks,

Guy