Topic starter
18/08/2026 2:40 pm
TL;DR: Scan fan-out, beacon cadence, exfiltration bursts, and long connections can be detected from flow records alone by mapping NetFlow, Zeek, and Suricata into a shared OCSF Network Activity stream, according to TENZIR. The key shift is that detection logic becomes portable and tunable, but only if field semantics stay stable and enrichment preserves trust boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by TENZIR: “Detect scans, beacons, and exfiltration over streaming OCSF”.
Key questions
Q: How should security teams design flow-based detections that work across different telemetry sources?
A: Start by normalising every source into a stable schema and then build detections against that schema, not the original log format.
Q: Why do cadence-based beacon detections work on flow records without payload inspection?
A: They work because beaconing is a repeated timing pattern, not a content problem.
Q: What breaks when long connections are not covered in network detection logic?
A: A beaconing implant that keeps one session open may never produce repeated flows, so cadence analysis has nothing to compare.
Practitioner guidance
- Standardise flow telemetry into one schema Map NetFlow, Zeek, Suricata, and cloud flow logs into a shared network activity model so detection logic does not depend on the source format.
- Separate findings from source events Publish detections on a dedicated findings stream while keeping raw telemetry available for storage, correlation, and later investigation.
- Tune cadence detectors against real traffic Use representative traffic to set minimum samples, interval bounds, size dispersion, and unanswered-attempt thresholds before production rollout.
Bottom line: Flow records can support meaningful detection even when payload inspection is unavailable, provided the analytic is built around timing, size, and fan-out patterns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
Portable detection depends on semantic discipline, not just telemetry volume. If a scan rule or beacon rule can move between NetFlow, Zeek, and Suricata, the real control is the stability of the mapped fields, not the sensor brand. That shifts detection engineering toward governance of schema meaning, provenance, and enrichment quality. Practitioners should treat field semantics as a security dependency, because inconsistent mappings can silently break an otherwise sound analytic.
A question worth separating out:
Q: How should teams evaluate whether flow-based exfiltration detection is trustworthy?
A: Teams should check whether the enrichment that marks traffic as internal or external is accurate, current, and consistently applied. If those labels are stale or inconsistent, outbound burst detection may flag the wrong asset or miss the real one. The practical test is whether the same transfer pattern produces the same judgement across the pipeline.
👉 Read our full editorial: Streaming network detections turn flow telemetry into portable findings