Many organizations carry a burdensome responsibility to various regulatory bodies like the Securities and Exchange Commission or the US Department of Health and Human Services. These bodies can levy heavy fines on businesses that fall out of compliance or can’t demonstrate that they complied with industry security standards. Among the many tools and platforms available to organizations, network traffic analytics—and more specifically, network detection and response (NDR) technology—has become a go-to solution used to help businesses demonstrate compliance.
Read moreBlog
STIX/TAXII for threat intelligence
Posted on - by Dylan Mclaughlin
What is STIX/TAXII?
STIX stands for Structured Threat Information Expression, which is an open-source language and serialization format used in sharing threat intelligence. Think of it as the vehicle for containing the threat information. Threat intelligence is communicated as objects and is detailed or as brief as the creator would like. TAXII stands for Trusted Automated Exchange of Indicator Information and is an application protocol that uses HTTPS/HTTP to enable communication. Think of this as the highway for STIX to travel on.
Read moreFirst look: Plixer’s machine learning engine explained
Posted on - by Stephen Tutterow
The purpose of this blog is to de-mystify the hype around machine learning (ML) by exploring three topics:
- What kind of ML is Plixer using and why?
- What insights or predictions can be drawn out of NetFlow, IPFIX, and metadata?
- Once applied, how do the results reduce the strain on network and security operations teams?
Returning to normal: monitoring the reintroduction of the workforce
Posted on - by James Dougherty
When this pandemic started and nearly the entire workforce went remote, our focus was to maintain the quality of service outside of what was then normal operations. Although it seems like we still have a long road to travel, we are starting to see signs of progress. Globally, many companies are opening up their offices and giving their employees the choice of working in the office or from home. For network administrators, this adds another layer of headache.
Read moreEnhance NetOps/SecOps collaboration with Plixer’s new collections feature
Posted on - by James Dougherty
I can’t tell you how many calls I’ve been on where the NetOps and SecOps teams really don’t know what the other is doing. Sadly, in today’s remote-work-centric world, the relationship between the two teams has become vital in making sure the end users not only have the resources they need, but at the same time, making sure everything is safe and up to compliance requirements.
Read moreHow to detect bogon connections
Posted on - by Elgin Robinson
Many ISPs filter bogon connections because bogon IP addresses have no legitimate use. If you find a bogon or bogus IP address in your firewall logs, it is likely due to a misconfiguration or someone intentionally creating a bogon connection for malicious purposes. This blog provides guidance on how to detect bogon connections with Plixer Scrutinizer and potentially discover other vulnerabilities that would compromise an enterprise network environment.
Read moreWe’ve released our biggest update ever, plus two new products
Posted on - by Alienor
One year ago, we announced our new vision. That is, we believe that SecOps and NetOps provide value for each other, and that value should be accessible from a single place. In pursuit of that vision, today we are releasing our biggest update ever for Plixer Scrutinizer, as well as two brand-new products.
Read moreDetecting IP spoofing with Plixer Scrutinizer and Beacon
Posted on - by Jake
A common tactic for bad actors to get a foothold into the network is to leverage IP spoofing to either:
- Gain access to a network using a valid IP address
- To man-in-the-middle a known service, allowing them to eavesdrop/intercept traffic
Regardless of the intention, IP spoofing can be a hard problem to track down if you don’t have proper monitoring in place. Today I will go over how this tactic can easily be detected and alarmed on using Scrutinizer and Beacon. This solution provides full endpoint device profiling as well as network traffic monitoring.
Read moreAdvanced Silver Peak monitoring with IPFIX
Posted on - by Brian Davenport
Competition generally ends up being good for the consumer. It keeps prices down and forces innovation as vendors compete for market share. A great example of this has been the explosion of vendors and features in the SD-WAN market—and from my perspective, one of the best things to come out of this has been the visibility offered from the enhanced metadata exports of the key players.
Read moreHome network quarantine project: Ubiquiti NetFlow
Posted on - by Stephen Tutterow
A few years back, Jake Bergeron, one of Plixer’s Sr. Solutions Engineers, wrote a blog about Ubiquiti NetFlow support and how to enable it. This was one of the first things I read as I started to beef up my home lab, because consumer-grade Ubiquiti gear is going to be 3 things:
Read more