7.3. About network baselining in the network graph

Procedure

1. Click the Namespaces list and use the search field to locate a namespace, or select individual namespaces.
2. Click the Deployments list and use the search field to locate a deployment, or select individual deployments to display in the network graph.
3. In the network graph, click on a deployment to view the information panel.
4. Select the Baseline tab. Use the filter by entity name field to further restrict the flows that are displayed.

5. Optional: You can mark baseline flows as anomalous by performing one of the following actions:

   • Select an individual entity. Click the overflow menu, , and then select Mark as anomalous.
   • Select multiple entities, and then click Bulk actions and select Mark as anomalous.
6. Optional: Check the box to exclude ports and protocols.
7. Optional: To save the baseline as a network policy YAML file, click Download baseline as network policy.

Procedure

1. In the RHACS portal, go to Network Graph.
2. Click the Namespaces list and use the search field to locate a namespace, or select individual namespaces.
3. Click the Deployments list and use the search field to locate a deployment, or select individual deployments to display in the network graph.
4. In the network graph, click on a deployment to view the information panel.
5. The Baseline tab lists the baseline flows. Use the filter by entity name field to further restrict the list of flows.
6. Optional: Check the box to exclude ports and protocols.
7. Click Download baseline as network policy.

Procedure

1. Click the Namespaces list and use the search field to locate a namespace, or select individual namespaces.
2. Click the Deployments list and use the search field to locate a deployment, or select individual deployments to display in the network graph.
3. In the network graph, click on a deployment to view the information panel.
4. In the Baseline tab, you can view baseline flows. Use the filter by entity name field to further restrict the flows that are displayed.

5. Toggle the Alert on baseline violations option.

   • After you toggle the Alert on baseline violations option, anomalous network flows trigger violations.
   • You can toggle the Alert on baseline violations option again to stop receiving violations for anomalous network flows.