Aflow collector(such asCisco Secure Network Analytics, formerly Stealthwatch) is a critical tool within a Security Operations Center (SOC) for providing "pervasive visibility" into the network. Instead of capturing every full packet—which is resource-intensive—a flow collector ingests NetFlow or IPFIX data, which contains metadata like source/destination IPs, ports, and the volume of data transferred.

The SOC leverages this data forthreat detection and responseby establishing a baseline of normal network behavior. When a flow collector identifies an anomaly—such as an endpoint suddenly sending gigabytes of data to an unusual external IP (data exfiltration) or scanning internal ports (lateral movement)—it flags the incident for analysis. UnlikeReal-time content filtering(Option D), which happens at the gateway (e.g., Cisco Umbrella or WSA), flow collectors provide a historical record and behavioral analysis ofallinternal and external traffic. They do not performload balancing(Option B) orbackup/recovery(Option A). In the Cisco SDSI framework, flow analysis is essential for identifying the "unknown unknowns" and providing the forensic evidence needed to understand the scope and path of a security breach.