WEBVTT

1
00:00.000 --> 00:02.580
So these are the four to view dashboards.

2
00:02.580 --> 00:04.620
And then below the line, these are referred to as

3
00:04.620 --> 00:06.540
four to view monitors.

4
00:06.540 --> 00:08.180
So if we click on threat and events,

5
00:08.180 --> 00:10.220
and then on the top left, go to the threats tab.

6
00:10.220 --> 00:11.140
So here's a map.

7
00:11.140 --> 00:13.180
So you can also click on the settings here,

8
00:13.180 --> 00:16.100
and change the settings regarding the map information.

9
00:16.100 --> 00:19.220
If we scroll down, here's the top threat destinations.

10
00:19.220 --> 00:20.860
Since I upgraded the four to analyze

11
00:20.860 --> 00:22.300
or to the newest version,

12
00:22.300 --> 00:23.700
I didn't put the four to give fireballs

13
00:23.700 --> 00:25.340
correct in their location.

14
00:25.340 --> 00:27.340
So here it's showing coming from this

15
00:27.340 --> 00:29.980
RFC 1918 private address base.

16
00:29.980 --> 00:31.580
So I'll do that in the future step
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.980 --> 00:31.580
So I'll do that in the future step

17
00:31.580 --> 00:33.500
by placing the firewall and the users

18
00:33.500 --> 00:36.140
behind the firewall back at the correct location.

19
00:36.140 --> 00:37.160
So there's a threat map.

20
00:37.160 --> 00:39.620
We can also use the drop down and go to settings,

21
00:39.620 --> 00:42.620
and we can do a 3D globe instead if we want, click on OK,

22
00:42.620 --> 00:44.060
which is pretty cool.

23
00:44.060 --> 00:45.460
So you can bring that around,

24
00:45.460 --> 00:48.700
see the top threat destinations based on 3D globe.

25
00:48.700 --> 00:50.700
There's also an option here under settings

26
00:50.700 --> 00:53.180
to go ahead and do a table view, click OK,

27
00:53.180 --> 00:54.840
which will simply put it into a table view,

28
00:54.840 --> 00:55.700
whatever you prefer.

29
00:55.700 --> 00:56.980
And once again, we can double click

30
00:56.980 --> 00:58.700
and drill down into any of these.

31
00:58.700 --> 01:00.180
Then we have top threats by weight and count.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
00:58.700 --> 01:00.180
Then we have top threats by weight and count.

32
01:00.180 --> 01:02.780
We can hover over these, get more information on them.

33
01:02.780 --> 01:05.620
If we scroll down, here's top virus incidents over time.

34
01:05.620 --> 01:07.940
And then below that, we have one local host

35
01:07.940 --> 01:09.700
that's the device that it's testing from,

36
01:09.700 --> 01:11.340
and it happened twice.

37
01:11.340 --> 01:13.100
Then we have indicators of compromise.

38
01:13.100 --> 01:14.980
So here's showing dark side, sinkhole,

39
01:14.980 --> 01:15.980
and command and control.

40
01:15.980 --> 01:17.900
I generated those just so I'd have it show.

41
01:17.900 --> 01:19.180
It's has a map here as well.

42
01:19.180 --> 01:21.100
And then in their local threat research,

43
01:21.100 --> 01:23.220
I only tried to download an I-Car test file

44
01:23.220 --> 01:24.060
a couple of times.

45
01:24.060 --> 01:26.140
So for a virus, it shows that.

46
01:26.140 --> 01:28.420
And then there's buttons for IPS, botnet, and application.

47
01:28.420 --> 01:31.820
However, the maximum here you can do for how long to look back
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:28.420 --> 01:31.820
However, the maximum here you can do for how long to look back

48
01:31.820 --> 01:33.140
is only seven days.

49
01:33.140 --> 01:35.860
So the IPS and botnet and application attacks

50
01:35.860 --> 01:37.340
that I did are more than seven days ago.

51
01:37.340 --> 01:40.300
So as we continue down here in these monitors,

52
01:40.300 --> 01:41.820
let's go to traffic analysis.

53
01:41.820 --> 01:43.940
And so on the top, we have our tabs.

54
01:43.940 --> 01:46.260
If you want to see them on the left-hand side here,

55
01:46.260 --> 01:49.020
we can do it that way or click on toggle horizontal menu.

56
01:49.020 --> 01:50.940
Either way is great, so I'll set that back.

57
01:50.940 --> 01:53.980
And here's the top sources based on IP address

58
01:53.980 --> 01:55.900
and 70, 0107.

59
01:55.900 --> 01:58.060
Here's the top countries and regions.

60
01:58.060 --> 02:00.820
And so we click, for example, on one of them,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
01:58.060 --> 02:00.820
And so we click, for example, on one of them,

61
02:00.820 --> 02:02.460
it'll put that in as a filter

62
02:02.460 --> 02:04.340
and then shows the details regarding

63
02:04.340 --> 02:06.180
gestation country United States.

64
02:06.180 --> 02:07.220
'Cause that's why I clicked on.

65
02:07.220 --> 02:09.580
And then we can sort based on applications, sessions.

66
02:09.580 --> 02:11.700
And once again, drill down right here,

67
02:11.700 --> 02:13.540
take a closer look at any of those details.

68
02:13.540 --> 02:15.900
Next across the top, we have applications and websites.

69
02:15.900 --> 02:18.660
So top website domains, top cloud applications,

70
02:18.660 --> 02:20.780
top browsing users, et cetera.

71
02:20.780 --> 02:22.900
And then for VPN, here we have MapView.

72
02:22.900 --> 02:24.460
I don't have any dial up VPN users,

73
02:24.460 --> 02:27.100
but I do have some VPNs or site sites.

74
02:27.100 --> 02:28.540
So we go to settings here.

75
02:28.540 --> 02:31.860
And let's go ahead and do a 3D globe and click on okay.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:28.540 --> 02:31.860
And let's go ahead and do a 3D globe and click on okay.

76
02:31.860 --> 02:33.900
Here I'm showing my site site in Madrid.

77
02:33.900 --> 02:35.100
And that's because the IP addresses

78
02:35.100 --> 02:38.980
for my public interfaces that I'm using are 23.1.2,

79
02:38.980 --> 02:41.900
which is associated in the public internet with Madrid.

80
02:41.900 --> 02:42.900
That's why it's showing up there.

81
02:42.900 --> 02:46.180
Or if we go to settings and I said that to table,

82
02:46.180 --> 02:48.380
it also shows us that our traffic is coming to

83
02:48.380 --> 02:49.580
and from Madrid.

84
02:49.580 --> 02:52.180
For SD-WAN, if you have SD-WAN operating,

85
02:52.180 --> 02:54.660
I do have SD-WAN on our branch firewall.

86
02:54.660 --> 02:56.620
So I'm going to specify the last three weeks.

87
02:56.620 --> 02:59.100
So I have one healthy device that's the branch firewall

88
02:59.100 --> 03:00.380
and it's HA-PAIR.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
02:59.100 --> 03:00.380
and it's HA-PAIR.

89
03:00.380 --> 03:01.500
I don't have any issues here.

90
03:01.500 --> 03:02.980
We can sort based on jitter,

91
03:02.980 --> 03:04.940
legacy packet loss and speed.

92
03:04.940 --> 03:07.660
Here it's showing that I don't have any SD-WAN SLA issues.

93
03:07.660 --> 03:09.420
And then it's showing me the applications

94
03:09.420 --> 03:11.340
are being used via SD-WAN.

95
03:11.340 --> 03:14.500
So the top consumer here is Netflix,

96
03:14.500 --> 03:16.700
and then Ubuntu updates and then AppGet

97
03:16.700 --> 03:17.820
and the rest are rounding here.

98
03:17.820 --> 03:20.100
So my topology, the only device I have sitting behind

99
03:20.100 --> 03:22.860
the branch firewall and it's HA-PAIR is PC7.

100
03:22.860 --> 03:24.500
So it's generating that traffic going out

101
03:24.500 --> 03:25.820
through the branch firewall,

102
03:25.820 --> 03:27.020
going out to the public internet.

103
03:27.020 --> 03:29.780
So we go to top SD-WAN device throughput here.

104
03:29.780 --> 03:31.520
It's also going to confirm that as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:29.780 --> 03:31.520
It's also going to confirm that as well.

105
03:31.520 --> 03:34.220
So here it's showing top SD-WAN device throughput

106
03:34.220 --> 03:35.900
and then here top SD-WAN talkers.

107
03:35.900 --> 03:38.340
Now, in addition to AD user seven,

108
03:38.340 --> 03:42.740
I also have a VPN that's leveraging the SD-WAN.

109
03:42.740 --> 03:45.020
So as I ping back and forth, for example,

110
03:45.020 --> 03:48.300
between the headcore site and the branch office

111
03:48.300 --> 03:50.580
or the VPN, which is going through the interfaces

112
03:50.580 --> 03:51.820
associated with SD-WAN,

113
03:51.820 --> 03:54.380
we also have some additional traffic shown here as well.

114
03:54.380 --> 03:55.940
But for AD user seven,

115
03:55.940 --> 03:58.100
that was most of that traffic is going out to the internet.

116
03:58.100 --> 03:59.420
And if I'm not mistaken,

117
03:59.420 --> 04:01.740
it was like Netflix traffic or YouTube traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
03:59.420 --> 04:01.740
it was like Netflix traffic or YouTube traffic

118
04:01.740 --> 04:02.980
based on what we looked at earlier.

119
04:02.980 --> 04:04.660
And then on our fabric devices,

120
04:04.660 --> 04:07.140
with the fabric state of security at the headcore site,

121
04:07.140 --> 04:08.540
I've got firewall one,

122
04:08.540 --> 04:09.580
which is the root of the fabric

123
04:09.580 --> 04:11.780
with firewall two and firewall threes that's shown here.

124
04:11.780 --> 04:13.540
Then we have local system performance.

125
04:13.540 --> 04:17.420
And we go ahead and select the last, how about three weeks.

126
04:17.420 --> 04:20.100
I'm here showing the multi core CPU performance.

127
04:20.100 --> 04:22.020
And this is on the 40 analyzer.

128
04:22.020 --> 04:23.540
And it's not too busy because it only has

129
04:23.540 --> 04:26.300
those four firewalls in my lab that are reporting to it.

130
04:26.300 --> 04:28.980
So the actual CPU usage is very, very low,

131
04:28.980 --> 04:31.380
but this is a great way visually to see how it's doing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:28.980 --> 04:31.380
but this is a great way visually to see how it's doing.

132
04:31.380 --> 04:33.220
As far as the insert rate and receive rate

133
04:33.220 --> 04:34.900
that refers to the logging.

134
04:34.900 --> 04:38.220
So as logs are being sent over to the 40 analyzer,

135
04:38.220 --> 04:40.380
how long does it take for it to receive those logs

136
04:40.380 --> 04:42.620
and then insert them, effectively insert them

137
04:42.620 --> 04:43.700
into the SQL database?

138
04:43.700 --> 04:45.340
So the blue is the receive rate

139
04:45.340 --> 04:47.700
and the orange here is the insert rate.

140
04:47.700 --> 04:49.780
And by default, it's showing us the last hour.

141
04:49.780 --> 04:52.100
Then if you scroll down here, CPU and memory usage,

142
04:52.100 --> 04:53.340
which are quite low.

143
04:53.340 --> 04:55.180
And if you scroll down here is the disk I/O,

144
04:55.180 --> 04:56.700
which is also quite low.

145
04:56.700 --> 04:58.500
And then here we have the receive rate and forwarding rate.

146
04:58.500 --> 05:01.860
So if we configure this 40 analyzer to forward logs
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
04:58.500 --> 05:01.860
So if we configure this 40 analyzer to forward logs

147
05:01.860 --> 05:03.140
to another device,

148
05:03.140 --> 05:05.340
we would also have the forwarding rate shown here.

149
05:05.340 --> 05:07.580
Because we're only receiving though on this 40 analyzer

150
05:07.580 --> 05:09.540
and we're not forwarding them to another device.

151
05:09.540 --> 05:11.460
Here we only have the receive rate being shown.

152
05:11.460 --> 05:13.660
And if we created custom views along the way,

153
05:13.660 --> 05:15.620
we could see them right here under custom views.

154
05:15.620 --> 05:16.740
But because it don't have any,

155
05:16.740 --> 05:19.100
it's giving us an option to go ahead and create

156
05:19.100 --> 05:20.100
a new custom view.

157
05:20.100 --> 05:22.140
So if we went back to, for example,

158
05:22.140 --> 05:24.820
traffic analysis and traffic tab here,

159
05:24.820 --> 05:26.380
and we set up these exactly what we wanted to,

160
05:26.380 --> 05:27.900
then we created a custom view

161
05:27.900 --> 05:30.580
and we'll call it our custom view and click on okay,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
05:27.900 --> 05:30.580
and we'll call it our custom view and click on okay,

162
05:30.580 --> 05:33.260
then that's gonna show up down here under custom views.

163
05:33.260 --> 05:34.900
And if we had multiple custom views,

164
05:34.900 --> 05:37.620
they'd be shown across the top as various tabs.