How deep can you dive into the activity crossing your networks?
Network activity monitoring is a security fundamental that some organizations do without, at their peril. Effective analysis of network session activity, or flow data, involves the collection and detailed classification of network behavior, as well as the ability to correlate network activity against log events and other security activities across your entire network.
Intelligence beyond simple log collection:
Contextual network knowledge from network activity isn't simply another surveillance source, rather it enables:
- Detection of threats in the network that aren't or can't be seen by security devices and other log sources
- Network self-discovery capabilities that build and maintain an accurate history of all assets on the network, (including their communication patterns, their server type, and running services)
- Network enabled processing of incoming information to understand and prioritize an event's severity (priority of the event contrasted to the vulnerability of the target) and relevance (priority of the event contrasted to the value of the target)
- Forensics in the form of detailed network sessions that is automatically correlated to incidents
Appliances:
Extracting native flow information from the network infrastructure, or working in tandem with QFlow collectors, QRadar flow processors enable the collection, analysis and storage of a variety of flow formats including NetFlow, CFlow, JFlow, SFlow, VFlow and QFlow.
1701 Flow Processor
- Scales to 600,000 flows per minute
- Multiple 1701 flow processors can be deployed for scaling
- The 1701 provides on-board 2TB of storage for detailed flow data analysis
- Dual redundant power supplies (auto-sensing)
- Embedded hardware RAID 10 for high availability and redundancy