Which feature of StealthWatch aggregates and normalizes NetFlow data?

NetFlow analytics describes the analytical process applied to flow data after collection, not the component that aggregates and normalizes the raw flows.

Advanced Malware Protection (AMP) is a separate Cisco product focused on file-based malware detection and is not a component or feature of StealthWatch.

Forensic investigation is a capability or use case enabled by StealthWatch, not the specific component that handles data aggregation and normalization.

The Cisco StealthWatch FlowCollector is the component that receives raw NetFlow, IPFIX, and other flow telemetry from routers, switches, and other exporters, then aggregates and normalizes that data before passing it to the StealthWatch Management Console for analysis. This separation of collection from analysis is core to StealthWatch's scalable architecture.