- play_arrow What's New for JSA Users
- play_arrow Capabilities in your JSA product
- play_arrow Dashboard Management
- Dashboard Management
- Default Dashboards
- Custom Dashboards
- Creating a Custom Dashboard
- Using the Dashboard to Investigate Log or Network Activity
- Configuring Dashboard Chart Types
- Removing Dashboard Items
- Detaching a Dashboard Item
- Renaming a Dashboard
- Deleting a Dashboard
- Managing System Notifications
- Adding Search-based Dashboard Items to the Add Items List
- play_arrow QRadar Analyst Workflow
- play_arrow Offense Management
- play_arrow Log Activity Investigation
- play_arrow Asset Management
- play_arrow Chart Management
- play_arrow Event and Flow Searches
- play_arrow Custom Event and Flow Properties
- play_arrow Rules
- play_arrow Historical Correlation
- play_arrow Juniper Networks X-Force Integration
- play_arrow Report Management
Deduplication
If your JSA deployment includes multiple Flow Processors that provide data to a Flow Processor, you can configure flow deduplication to remove duplicate flows. The flow deduplication process ensures that flow records with the same unique identifier are reported only once.
Before discarding the duplicate flow, JSA merges the following fields with the original flow record so that you can tell where the duplicate record was observed on the network.
Flow source ID
Flow source name
Source ASN
Destination ASN
Input IF index
Output IF index
Configuring Flow Deduplication
You can configure flow deduplication to take place at either the Flow Processor.
When your Flow Processor receives data from two different flow sources that are monitoring the same part of the network, configure deduplication at the Flow Processor appliance. For example, your Flow Processor might receive data from a 3rd party flow exporter as well as its own network TAP.
When you have two different Flow Processors that monitor overlapping parts of the network, the individual flow processors are unaware of the deduplication. In the scenario, you configure deduplication at the Flow Processor appliance.
You can set the flow deduplication method in the configuration settings for the appliance. For more information, see Configuring a Flow Processor.
