Network Flow Analysis. egambit, your defensive cyber-weapon system. You have the players. We have the game.

Size: px

Start display at page:

Download "Network Flow Analysis. egambit, your defensive cyber-weapon system. You have the players. We have the game."

Gavin Little
7 years ago
Views:

1 egambit Network Flow Analysis egambit, your defensive cyber-weapon system. You have the players. We have the game. TEHTRI-Security

2 Network Flow analysis In this document, we will introduce how egambit can help at analyzing network flows: creating live security alerts, and checking post-incident situations with a network time machine engine. Based on egambit version 3.1 September 2015

3 About network flow analysis - For security reasons, you might sometimes ask yourself questions like who talked to who, when, how, for how long - Hopefully, the NetFlow protocol has tremendous features built for networkers (accounting ), but it can also be used in the IT Security field - NetFlow allows to keep chosen meta data that will be recorded for further analysis thanks to samples made on a regular basis Ø Source IP + Destination IP Ø Source Port + Destination Port Ø Protocol, Timestamp, Size of data

4 About egambit and NetFlow - egambit can collect the NetFlow datagrams generated by your devices and supporting versions 5, 7 and 9 Ø Routers & Switches: Cisco, Juniper, Nortel Ø Security/FW devices: Cisco ASA, Palo Alto Ø Cloud infrastructures: VMWare ESXi - egambit supports IPv4, IPv6, MPLS, Multicast - egambit can also generates its own NetFlow for you by listening to the traffic caught on dedicated interfaces (mirroring, TAP)

5 e.g. what are the main services used on a period?

6 e.g. who were the main talkers? bandwidth usage, exfiltration

7 e.g. what were the trends? TCP peak at night UDP peak

8 Live Intrusion Detection - egambit has a live intrusion detection analysis working on any flows caught Ø NetFlow based signatures working on behaviors analysis looking at talkers on the network - Examples Ø Detection of really slow and stealth network scans during hours, and deeply hidden in your network Ø Per customer policies support written to alert when unwanted traffic occurs in specific network area SCADA network with TCP/UDP traffic Webfarm with admin traffic from unusual sources

9 Live Intrusion Detection Scanning activity automatically detected with NetFlow analysis

10 Offline Intrusion Analysis time machine on your flows Forensics - egambit allows to conduct network forensic analysis Ø Advanced features through manual research - You can crawl back in the past, like a kind of network time machine on your flows, in order to answer to powerful questions like Ø Who talked to whom, when, how much did they exchanged, what protocols were used, for how long, etc - Example Ø One compromised workstation, controlled by a remote C&C, launched an in-depth scan in your network. With egambit, you will find any dialogs: what was scanned? how big were the exchanges? when did it happened?

11 Offline Intrusion Analysis time machine on your flows Forensics

12 Synthesis egambit & Flow Analysis Forensics - Two complementary levels of work Ø Live Intrusion Detection alerts Ø Offline Intrusion Analysis (time machine) - Multiple skills and features added to your security Ø Know your flows and the related trends Ø Improve policies and check compliance Ø Detect unusual and unwanted flows Ø Follow weird behaviors and anomalies Ø Detect hidden scanners, insiders threats Ø Retrieve APT, lateral movements, malwares Ø Increase SOC/CSIRT capacities and speed Ø Ease Forensics and Incident Management

13 Join us Ready for innovative solutions against cyber threats?

14 security.com egambit egambit is a product that can monitor and improve your IT Security against complex threats like cyber-spy or cyber-sabotage activities. This product is realized by the TEHTRI-Security company in FRANCE. It is fully designed and developed near Bordeaux, and Paris as well. Created in 2012, the egambit product has already helped some companies in China, Brazil, USA and Europe against internal and external cyber threats. In 3 years egambit has already caught billions of events related to security issues worldwide, thanks to the tremendous skill and motivation of expert Consultants working on the project with a real Ethical Hacking spirit. 100% of the source code is within TEHTRIS hands, and it was designed with extended security features. egambit is your defensive cyber-weapon system.

15 egambit Your defensive cyber-weapon system You have the players. We have the game. Let s use egambit in your environment, in order to improve hardening and detection of security issues and incidents.

16 Follow-up Do not hesitate to contact our team TEHTRI-Security Managed Security Service Provider egambit Complete defensive weapon

Endpoint Security - HIPS. egambit, your defensive cyber-weapon system. You have the players. We have the game.

Endpoint Security - HIPS. egambit, your defensive cyber-weapon system. You have the players. We have the game. egambit Endpoint Security - egambit, your defensive cyber-weapon system. You have the players. We have the game. TEHTRI-Security 2010-2015 www.tehtri-security.com Endpoint Security In this document, we