Flows

Flows

Flows are the core building block of SilentPulse. They define the expected path of security data through your infrastructure.

What is a Flow?

A flow represents a data pipeline: which assets should report what type of telemetry, through which systems, and how often.

Asset Group → Observation Type → Integration Point
(Windows Servers) → (EDR Events) → (Splunk via Kafka)

Flow Components

Asset Groups

Collections of assets that share monitoring requirements:

• Windows Servers
• Linux Workstations
• Network Devices
• Cloud VMs

Asset groups can be synced from CMDB or defined manually.

Observation Types

The type of telemetry expected from assets:

• EDR/XDR Events
• Firewall Logs
• Authentication Logs
• DNS Queries

Integration Points

External systems where you check for observations:

• SIEM (Splunk, Elastic, Sentinel)
• Message queues (Kafka, RabbitMQ)
• Log aggregators
• APIs

Creating a Flow

1. Define the Asset Group - Which assets should report?
2. Choose Observation Type - What telemetry is expected?
3. Configure Integration - Where to check for data?
4. Set Thresholds - How long before alerting on silence?

Flow States

State	Description
Healthy	All expected assets are reporting
Degraded	Some assets are silent
Critical	Many assets are silent
Unknown	Unable to evaluate (integration error)

Multi-Stage Flows

For complex pipelines, flows can have multiple stages:

Endpoints → Collector → Kafka → SIEM

Each stage is monitored independently, so you know exactly where data is dropping.