In reply to Igor Balabine.

Hi Igor! We fully process network event data in the log management system. We are huge consumers of Netflow, although I don't believe that ALL flows need to be indexed into a log management system. At CIsco, we collect over two billion unique flow records per day, which would be a huge cost for us to index, store, and retain. Rather than sending our captured flows to the log management system, we simply use alarms we've configured in our flow storage and capture systems as indicators. Those alarms are indexed and we can use those to go start an investigation. Of course we still store the raw flows as well (although they are not indexed) that we can query manually at any time. Netflow will always be a part of our toolkit, but it not necessary to index all your flows to make it a useful event source.

There are also hosts that do not generate logs as you accurately mention, however in those cases we depend on network events such as lateral movement detection (often through a HIPS) or crossing network choke points (via Netflow, IPS, etc.)