Latest features, improvements, and product updates on Kentik's Network Observability platform.
Users no longer have to indicate to Kentik what flow type they are sending (e.g. NetFlow, sFlow, IPFIX) – from now on, Flow Type isn’t specified anymore at device creation time and will be auto-detected by the Kentik Detect Ingest point itself. In the Admin Device List, the “Flow” column now indicates what flow type we are receiving and auto-detecting from each device.
Every now and then, the simplest feature unveils a world of possibilities. The new ability to “pivot” a row in the Data Explorer is a great example.
Clicking on the menu at the right of a row in the Data Explorer and selecting “Pivot” opens a (configurable) dashboard showing many different views of the chosen row of data based on different combinations of dimensions and metric.
This pivot feature allows rapid and comprehensive data exploration, reducing the need to manually construct a series of several ad-hoc views in the Data Explorer, for example when trying to identify “why this unexplained bump over this traffic graph occurred.”
For instance, if I am suspicious of traffic sourced in the Netherlands going to a specific IP address, here’s what I would do, taking advantage of the pivot feature:
Below, we see a dashboard that decomposes this NL → dest. IP traffic into multiple different dimensions, without making me go through the trouble of building a unique dashboard.
The pivot feature makes new paths of investigation practical that wouldn’t otherwise have been explored due to the time required to build such a dashboard, and the interruption building a dashboard causes to the investigation workflow.
The pivot feature is discussed in this Knowledge Base entry.
As you’ve probably noticed, we revamped the UI of Data Explorer’s Query sidebar to further streamline its appearance.
At the same time, we’ve also added the ability to Create, Edit, and Save Views. Where you previously needed to rebuild your favorite queries in Data Explorer, you can now save them and go back to them to refine them or even share them.
The full documentation on Saved Views is available in our knowledge base under this article.
Saved Views come with an overhauled Data Explorer menu allowing quick access to them.
A new Saved Views Library section has been started, allowing users to share Saved Views within the same company, or even leverage Kentik’s library of pre-existing views.
This marks the initial steps towards a community driven initiative that will be started in the future for Kentik users to share their recipes on Dashboards, Views, Alerting policies.
Directly from the Data Explorer, look for the Save and **Load **controls at the top. With these, no more starting all over from scratch when improving on your (or your co-users’) existing visualizations. Conveniently load them and save them anytime.
Here’s a quick display of what the new Saved Views Library looks like:
Stay tuned and watch this community concept trickle down into further areas of the Kentik Detect Portal in the future.
Kentik has fully supported storage and querying of IPv6 for some time, and we are steadily adding support for IPv6 in any place where addresses or prefixes are used.
Next-hop IP dimension in explorer and dashboards now supports IPv6 on top of the existing IPv4, as displayed in the Data Explorer Dimension selector below. Note that different CIDR thresholds can be set independently for IPv4 and IPv6.
Metrics support for IPv6 added to explorer and dashboards: Unique src/dst prefix, Unique SRC/DST ASN, and Unique src/dst IP now support ipv6.
Alerting is now fully documented in our Knowledge Base; feel free to swing by and get a more detailed view of what it offers!
Additionally, Alerting now supports Route Prefix and Length (Prefix/LEN) both as a Dimension and in Filters.
APIv5 documentation has been entirely updated, and is now available to our users at the following locations:
| v5 API for administration of Kentik Detect Objects | here |
| v5 Query API to pull data from Kentik Detect Engine | here |
| v5 API sandbox / tester | here |
Additionally, an API functionality to return a URL to open an API call in browser (authenticated) has also been added.
Important note: The current plan is to shut down former API versions (namely v1 and v4) on May 5th.
ICMP code and type for v9/IPFIX is now supported. It is overloaded into the IP DST PORT values based on NetFlow v5 ICMP encoding.
On top of the already offered RTBH mitigation method, our Anomaly Detection system now supports integration with A10’s Thunder TPS Series mitigation hardware.
What this means is that if you already own or plan on acquiring such appliances, you can leverage all of Kentik Detect’s powerful Anomaly Detection system and couple it with A10 for mitigation.
To configure the Kentik end of an A10 TPS mitigation platform for use within policies, go to the Mitigation menu under the Alerts and click on the +Create Mitigation Platform, as shown in the screenshots below:
Matrix visualizations are described at length in this Knowledge Base article.
A “Matrix view” is now available in the Data Explorer, find it amongst the already existing Display Types section of the query side panel.
Here are a few examples of uses cases for Matrix Views:
More details on Look-back Alert Policy settings in this Knowledge Base entry.
You can now use the Minimum Look-back setting to specify the minimum number of hours or days that baseline data collection is performed before a baseline is made available for comparison by alerting policies.
More details on Alert Notification Channels in this Knowledge Base entry.
You now create a new notification channel from directly within the threshold notification-add function.
Knowledge Base entries detailing Dashboard usage and creation are located here.
The dashboard layout infrastructure has been redesigned to improve speed and ease of use. This comes with a streamlined user experience as part of our constant effort to streamline usability of our most used features.
Exports and scheduled reports have been redesigned for ease of use. Here’s an example of the overhauled Email Subscription experience:
And the Export feature in Dashboards and Views updated experience:
You can now tell the state of your BGP sessions in the Device List table in the Devices page, which is found under the Admin menu.
Tagging now supports regex for device names and interface fields, and supports IPv6.
As a reminder, a comprehensive table references all types of inputs for all of the available Tag Fields, it is located here.
For instance, if your interfaces always include consistent descriptions, you could potentially match said interface descriptions on either ‘PNI’ or ‘Peer’ or ‘customer’ and tag all the matches as ‘Peering’ to then be able to filter them in or out of any Data Explorer query.
You can now see the API calls in Data Explorer as prettified JSON, making it much easier for your users to identify the fields at play in your API calls.
The idea here is to further simplify the task of integrating with the Kentik API under the following methodology:
To describe the underlying API call of a given view, proceed as illustrated below – starts with clicking the Hamburger Menu icon on the top-right side of a view
Peering analytics now supports IPv6 as well as showing the full path on mouseover.
Data Explorer now supports graph highlighting and click and drag operation on the timeline to zoom in to the selected timeframe. Following on to a horizontal click and drag, the side query panel will automatically update its “Time” fields and a zoomed-in graph will be spawned.
A table view has been added to the existing display types on top of the existing chart types.
Beyond their basic appearance, Table views are highly customizable in terms of columns they display and can amongst others allow to build computed fields in a very comprehensive manner. These advanced options for the table widget are available by clicking on the hamburger menu at the top right end of the table component.
Table View Options details can be found in our Knowledge Base under this article.
Custom Dimensions correspond to user defined Flow Enrichment Custom Columns. What that means in practice is that users are now able to programmatically enrich their flow data with columns (5 custom dimensions are allowed per account) that can be grouped-by, summed, max’ed, etc.
Unlike Tags or Saved Filters, Custom Dimensions only affect the flows being considered in a request. Custom Dimensions provide an efficient way of breaking down your visualizations by your own business contextualized data groupings.
Values for each custom dimension can be set via:
customer_type _Custom Dimension based on the IP Ranges within which the customers are hosted.The extensive documentation around Custom Dimensions can be found here in our KB
The extensive documentation around Saved Filters is located here in our KB
Saved Filters are a new addition to Kentik Detect’s take on how to slice and dice data in the Data Explorer in an increasingly quick and convenient manner.
Remember the days where you needed to build a complex filter from scratch when going back to the Data Explorer screen? Those days are over. With Saved Filters, you can conveniently save filters you use on a regular basis and call them from the Data Explorer Filter section any time.
Here’s what filters look like now: If you were to build that filter of destination French ISPs every time you create a query, it could be quite a chore… here’s what your filter would look like:
Saved Filters to the rescue. Now you can now save that filter by clicking on the disk icon at the top of the filter group, and re-use it sometime later.
Voila! You can now invoke this filter any time directly from the filter screen:
Double-click the filter’s name and you can invoke its opposite, in this case filter on any destination ASN but the French ones you previously listed!
Additionally, Saved Filters are shareable between users at a company level, as well as Kentik offers common pre-set filters. To get a view of all filters, just hop on to Admin → Saved Filters:
In a future release, Saved Filters will adopt a library view to facilitate collaboration and sharing, so stay tuned!
When selecting dimensions in Data Explorer, users now can configure separate aggregation/grouping levels for IPv4 or IPv6, from a single location in the Query Side Panel:
Detailed steps to get setup with nProbe and Kentik are detailed over in this Knowledge Base section.
nProbe now allows you to export flow data to Kentik Detect’s Flow Data platform, unveiling a whole new array of host-level traffic and performance info.While previously limited to flow-data from your networking gear, Kentik now brings server/data-center level metrics to the powerful performance analysis tools it already offers (Custom Dimensions, Tagging, Filtering…).
With nProbe able to send flow data to the Kentik Detect big data platform, the realm of query-able metrics now extends to network performance for such devices, including:
This first set of performance metrics paves the way for the future addition of application-specific Dimensions to enrich flows exported from servers.
The screenshot below shows how registration of nProbe hosts happens in the Kentik Detect Portal:
The multiple time series view options will soon enough be detailed in this section of our knowledge base.
Currently in its Beta stage, this feature now allows you to combine multiple graphs in the Data Explorer (and dashboards) into one single, comprehensively configurable representation. This can prove handy when trying to establish causality between different observed phenomena.
Below is a simplistic view of Destination and Source traffic broken down by ASNs:
