FlowSphera 1.6.0 release notes

Port scans, password guessing and DDoS on the Events page. The collector checks every 10 minutes (and the last day at its first start) and keeps what it finds: one event per source or service that grows while the activity goes on (first and last time, how often), not one line per flow.
- Port scan: one outside address calls 10+ ports of yours, 3+ of your management services, or one port on 10+ of your addresses within 10 minutes.
- Password guessing: 30+ sessions from one address to a sensitive service (SSH, RDP, management, VPN portals …) in 10 minutes. The single knocks of internet-wide scanners are summed up instead: one Probes of … event a day per service, with the number of addresses and their countries.
- Aggressive client: 200+ sessions in 10 minutes from one address to a public service (a web site).
- DDoS / flood: new sessions to a service, inbound traffic of a device, or UDP from amplifier ports (DNS, NTP, SSDP, memcached …) at 10× its own usual peak (99th percentile of the last week) and above a floor, in 3 of 10 minutes.
- Inside host scans the internet / Scan inside the network: a host of yours calls many addresses or ports and gets no answers — a sign of malware.
Who opened a connection is worked out from the records (NetFlow has no such field; FortiGate sends no TCP flags): the two records of a session and both halves of a NAT translation are joined, and the services on your side are learned hourly from what outside addresses call. Your web sites are recognised as public and only floods and aggressive clients count there; the firewall's own lookups (FortiGuard, DNS) are not mistaken for scans.
Settings → Events (administrators): every kind on or off, its priority (info / warning / critical) and thresholds; the learned services with their role (public, sensitive, ordinary); addresses, networks and ASNs to ignore; the sensitive and public ports. Ignore on an event adds its source to the list.
The Events page follows the period and the filters like every other page: a host, an outside address, a device, a country, an ASN or a port shows only the events about it (an address also matches the events that list it — a probe summary with it among the sources); filters that do not apply to events (service, protocol, interfaces) are named on the page. An event's Filter sets an outside attacker as ext. IP (it used to set host, which matches inside addresses only, so the other pages showed nothing). It also filters by priority and lists what is watched with each kind's priority.
Firewalls export only the traffic they let through: scans of closed ports are not seen there, calls to open services and published ports are.
Geolocation → Live connections: a very long destination no longer pushes the bytes of every row out of the panel until it scrolls away; long names end with “…”.