Topic starter
18/08/2026 2:40 pm
TL;DR: Flow records can surface scan fan-out, beacon cadence, exfiltration bursts, and long connections even without payload inspection, according to TENZIR. Portable detection depends on stable schema mappings and trustworthy enrichment, not the original sensor source.
Editorial analysis by NHI Mgmt Group, based on content published by TENZIR: “Detect scans, beacons, and exfiltration over streaming OCSF”.
Key questions
Q: Why do cadence-based beacon detections work on flow records without payload inspection?
A: They work because beaconing is a repeated timing pattern, not a content problem.
Q: What breaks when long connections are not covered in network detection logic?
A: A beaconing implant that keeps one session open may never produce repeated flows, so cadence analysis has nothing to compare.
Q: How should security teams design flow-based detections that work across different telemetry sources?
A: Start by normalising every source into a stable schema and then build detections against that schema, not the original log format.
Practitioner guidance
- Standardise flow telemetry into one schema Map NetFlow, Zeek, Suricata, and cloud flow logs into a shared network activity model so detection logic does not depend on the source format.
- Separate findings from source events Publish detections on a dedicated findings stream while keeping raw telemetry available for storage, correlation, and later investigation.
- Tune cadence detectors against real traffic Use representative traffic to set minimum samples, interval bounds, size dispersion, and unanswered-attempt thresholds before production rollout.
Bottom line: Flow records can support meaningful detection even when payload inspection is unavailable, provided the analytic is built around timing, size, and fan-out patterns.
Glossary terms: Flow telemetry, Beacon Cadence, Network activity schema, Long-connection detection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
18/08/2026 3:25 pm
Portable detection depends on semantic discipline, not just telemetry volume. If a scan rule or beacon rule can move between NetFlow, Zeek, and Suricata, the real control is the stability of the mapped fields, not the sensor brand. That shifts detection engineering toward governance of schema meaning, provenance, and enrichment quality. Practitioners should treat field semantics as a security dependency, because inconsistent mappings can silently break an otherwise sound analytic.
A question worth separating out:
Q: How should teams evaluate whether flow-based exfiltration detection is trustworthy?
A: Teams should check whether the enrichment that marks traffic as internal or external is accurate, current, and consistently applied. If those labels are stale or inconsistent, outbound burst detection may flag the wrong asset or miss the real one. The practical test is whether the same transfer pattern produces the same judgement across the pipeline.
👉 Read our full editorial: Streaming network detections turn flow telemetry into portable findings