mirror of
https://github.com/netbirdio/docs.git
synced 2026-04-16 07:26:35 +00:00
[management] Network traffic events docs (#291)
* Rename Network Activity Logging to Audit Activity Logging Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com> * refactor the audit events doc Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com> * add management traffic event doc Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com> * Update audit events logging image Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com> * Update event streaming image Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com> * Update src/pages/how-to/traffic-events-logging.mdx Co-authored-by: Misha Bragin <bangvalo@gmail.com> * Update src/pages/how-to/traffic-events-logging.mdx Co-authored-by: Misha Bragin <bangvalo@gmail.com> * Update src/pages/how-to/traffic-events-logging.mdx Co-authored-by: Misha Bragin <bangvalo@gmail.com> * Update docs to clarify feature availability Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com> * add link --------- Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com> Co-authored-by: Misha Bragin <bangvalo@gmail.com> Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
This commit is contained in:
Binary file not shown.
|
Before Width: | Height: | Size: 394 KiB After Width: | Height: | Size: 408 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 142 KiB After Width: | Height: | Size: 502 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 428 KiB |
@@ -158,7 +158,8 @@ export const docsNavigation = [
|
||||
{
|
||||
title: 'Activity',
|
||||
links: [
|
||||
{ title: 'Network Activity Logging', href: '/how-to/monitor-system-and-network-activity' },
|
||||
{ title: 'Audit Events Logging', href: '/how-to/audit-events-logging' },
|
||||
{ title: 'Traffic Events Logging', href: '/how-to/traffic-events-logging' },
|
||||
{
|
||||
title: 'Stream Activity Events',
|
||||
href: '/how-to/activity-event-streaming',
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Network Activity Logging
|
||||
# Audit Events Logging
|
||||
|
||||
The network activity logging functionality in NetBird allows you to observe and track changes to your network infrastructure.
|
||||
The Audit events logging functionality in NetBird allows you to observe and track changes to your network infrastructure.
|
||||
This includes events such as when a new machine or user has joined your network, when access control policies have been modified,
|
||||
and many other key network events.
|
||||
|
||||
@@ -11,11 +11,11 @@ To get started with event logging in NetBird, watch this introductory video:
|
||||
<iframe width="560" height="315" src="https://www.youtube.com/embed/UlnMo1KYXPU?si=JdzEr9v2EZHlP7lc" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
|
||||
|
||||
|
||||
## Access the Activity Logging View
|
||||
The activity logging feature is enabled by default for every NetBird network. You can access the activity log in the web UI under the [Activity tab](https://app.netbird.io/activity). This view provides a centralized log of network events. You can use the search bar to search by activity name, and apply filters for timeframes, event types, and users.
|
||||
## Access the Audit Events Logging View
|
||||
The audit events logging feature is enabled by default for every NetBird network. You can access the activity log in the web UI under the [Audit Events tab](https://app.netbird.io/events/audit). This view provides a centralized log of network events. You can use the search bar to search by activity name, and apply filters for timeframes, event types, and users.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/activity-monitoring.webp" alt="activity-monitoring" className="imagewrapper-big"/>
|
||||
<img src="/docs-static/img/how-to-guides/activity-monitoring.png" alt="activity-monitoring" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
The current version of NetBird tracks a wide range of network changes that occur in the Management server, such as modifications to peers, groups, system settings, setup keys, and access control policies.
|
||||
@@ -120,9 +120,9 @@ Future versions will also support connection events that occur in NetBird agents
|
||||
If the configuration files have been generated by the `configure.sh` script, you can find the previous encryption key in the backup files in the same folder as the script. Look for the <b>DataStoreEncryptionKey</b> field in the `management.json` backup file.
|
||||
</Note>
|
||||
|
||||
## Enable Activity Event Streaming to SIEM Systems
|
||||
## Enable Audit Events Streaming to SIEM Systems
|
||||
|
||||
NetBird can stream activity events to your Security Information and Event Management (SIEM) system in real-time. With this feature enabled, you can monitor and analyze NetBird network changes within your SIEM infrastructure. Check the [integrations guide](/how-to/activity-event-streaming) for more information about the supported integrations and how to enable them.
|
||||
NetBird can stream audit events to your Security Information and Event Management (SIEM) system in real-time. With this feature enabled, you can monitor and analyze NetBird network changes within your SIEM infrastructure. Check the [integrations guide](/how-to/activity-event-streaming) for more information about the supported integrations and how to enable them.
|
||||
|
||||
## Get Started
|
||||
|
||||
45
src/pages/how-to/traffic-events-logging.mdx
Normal file
45
src/pages/how-to/traffic-events-logging.mdx
Normal file
@@ -0,0 +1,45 @@
|
||||
# Traffic Events Logging
|
||||
|
||||
<Note>
|
||||
This feature is available only in the NetBird cloud and on the [Business plan](https://www.netbird.io/pricing?utm_source=docs&utm_content=traffic-events).
|
||||
It is an experimental feature, and its functionality and behavior may evolve, including changes to how data is collected
|
||||
or reported.
|
||||
To use this feature, ensure you have NetBird client version 0.39 or higher.
|
||||
</Note>
|
||||
|
||||
|
||||
The traffic events logging functionality enables comprehensive monitoring and analysis of connections across your infrastructure.
|
||||
It captures network activity, including peer-to-peer, site-to-site, peer-to-resource, and other network traffic events.
|
||||
|
||||
It provides detailed visibility into connections and network traffic flow, helping to answer key questions such as who initiated
|
||||
the connection, what resource was accessed, when it happened, where it originated, and why it was allowed. By enhancing
|
||||
network monitoring capabilities, it strengthens security measures and delivers actionable operational insights, empowering
|
||||
you to better manage and secure your environment.
|
||||
|
||||
|
||||
## Enabling Traffic Events Logging
|
||||
|
||||
Traffic events logging is disabled by default. To enable it on the NetBird dashboard, navigate to `Settings > Networks`.
|
||||
Under the Experimental section, you’ll find the `Enable Traffic Events` option. Toggle the switch to enable traffic event logging.
|
||||
|
||||
By default, traffic reporting in userspace is always enabled, providing basic logging of network interactions.
|
||||
However, packet size reporting at the kernel level is disabled by default to minimize CPU usage.
|
||||
|
||||
<Note>
|
||||
You can optionally enable `Traffic Reporting (Kernel)` to capture additional details, such as network packet sizes,
|
||||
at the kernel level. Be aware that enabling this option may lead to higher CPU usage on the NetBird client.
|
||||
</Note>
|
||||
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/traffic-events-logging-settings.png" alt="traffic-events-logging-settings" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
|
||||
## Enable Traffic Events Streaming to SIEM Systems
|
||||
|
||||
NetBird allows you to stream traffic events directly to your Security Information and Event Management (SIEM) system in real time.
|
||||
By enabling this feature, you can seamlessly monitor and analyze NetBird network flow events within your existing SIEM infrastructure,
|
||||
enhancing your ability to detect and respond to security events.
|
||||
|
||||
For detailed instructions on supported integrations and how to set them up, refer to the [integrations guide](/how-to/activity-event-streaming).
|
||||
Reference in New Issue
Block a user