WEBVTT 1 00:00.000 --> 00:05.100 So now that we have our ID/IPS profiles being used as part of a rule with the 2 00:05.100 --> 00:08.520 shooting firewall, it's now time to go ahead and test and verify to see whether 3 00:08.520 --> 00:13.880 or not the ID/IPS policies and rules that we've applied are picking up the 4 00:13.880 --> 00:17.200 traffic flows between this client right here that's connecting to and 5 00:17.200 --> 00:17.680 interacting 6 00:17.680 --> 00:21.720 with our Metasplatable version 2 device right here. So I took the liberty of 7 00:21.720 --> 00:24.520 running a whole bunch of different end map scans. There's one that's just 8 00:24.520 --> 00:27.640 finishing up right there. And in addition to that I also launched several 9 00:27.640 --> 00:31.600 different attacks using Metasplatable. So some of that traffic definitely WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 9 00:27.640 --> 00:31.600 different attacks using Metasplatable. So some of that traffic definitely 10 00:31.600 --> 00:32.000 should 11 00:32.000 --> 00:38.440 be picked up and identified via the ID/IPS policy and corresponding rule. So to 12 00:38.440 --> 00:42.920 verify that let's head over to the NSX manager and see what it found. So here 13 00:42.920 --> 00:47.080 in the NSX manager we'll go to the security tab up here on top, we'll expand 14 00:47.080 --> 00:50.560 the left-hand side and then on the first option here security overview we'll 15 00:50.560 --> 00:50.760 click 16 00:50.760 --> 00:55.240 on that and then here under threat event monitoring we'll now click on ID/IPS. 17 00:55.240 --> 00:58.960 And sure enough we now have something to look at. So here are intrusion events 18 00:58.960 --> 00:59.160 and 19 00:59.160 --> 01:03.200 unique intrusion signatures that were matched with one of them in the high WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 19 00:59.160 --> 01:03.200 unique intrusion signatures that were matched with one of them in the high 20 01:03.200 --> 01:08.080 category and seven of them in the suspicious category. Also from here if we 21 01:08.080 --> 01:12.440 had gateway-based intrusion detection also set up we could filter based on that 22 01:12.440 --> 01:12.440 . 23 01:12.440 --> 01:16.120 So if we click here under all traffic we click on gateway only it should be 24 01:16.120 --> 01:19.880 nothing and everything should be under the distributed only category because 25 01:19.880 --> 01:22.960 that's where our current rules are in place. Then if we continue to scroll down 26 01:22.960 --> 01:28.720 here is our distributed IPS/IDS summary also showing the top VMs which is our 27 01:28.720 --> 01:32.440 Kali 10 box is initiating all that traffic and if we scroll down further we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 27 01:28.720 --> 01:32.440 Kali 10 box is initiating all that traffic and if we scroll down further we 28 01:32.440 --> 01:36.640 have our gateway-based ID/IPS which we don't have enabled yet. So the cool 29 01:36.640 --> 01:36.800 thing 30 01:36.800 --> 01:40.880 is right from here if we want to get more information we could go to security 31 01:40.880 --> 01:41.040 on 32 01:41.040 --> 01:45.520 left down to under threat event monitoring ID/IPS or we can just click 33 01:45.520 --> 01:48.920 right here and it'll take us right there. So let's click here on this section 34 01:48.920 --> 01:49.040 for 35 01:49.040 --> 01:52.720 intrusion events and that whisks us away through time and space over here to 36 01:52.720 --> 01:57.480 IPS/IDS. That's currently what we're looking at right here and so because we 37 01:57.480 --> 02:00.640 are looking at the distributed only earlier that's where it took us to here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:57.480 --> 02:00.640 are looking at the distributed only earlier that's where it took us to here 38 02:00.640 --> 02:04.240 so we could click on all traffic and that would include any gateway-based 39 02:04.240 --> 02:08.560 ID/IPS that we have as well. So this showing is the timeline for some of those 40 02:08.560 --> 02:12.080 attacks also if we want to remove some we could say for example I don't want to 41 02:12.080 --> 02:16.400 see anything that's low or medium or high and then we collapse the left-hand 42 02:16.400 --> 02:20.040 side gives the more room or suspicious and then it would only show us the 43 02:20.040 --> 02:23.240 critical alerts which I currently don't have any so let me just ask for 44 02:23.240 --> 02:23.720 critical 45 02:23.720 --> 02:26.520 and high and that's not showing us this highlight right here so if we hover 46 02:26.520 --> 02:30.440 over that it gives us more information on it. Also if we click here it also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 46 02:26.520 --> 02:30.440 over that it gives us more information on it. Also if we click here it also 47 02:30.440 --> 02:33.400 expands it down here below so we can get more information on it. So here we 48 02:33.400 --> 02:33.480 have 49 02:33.480 --> 02:37.360 the impact score the severity last detected and information if we scroll 50 02:37.360 --> 02:41.000 down a little further has details about the parties involved. So if we continue 51 02:41.000 --> 02:45.160 to scroll down here and the purple is indicating that it was detected only and 52 02:45.160 --> 02:49.200 because I had set the rule up to detect only and not to prevent that's why we 53 02:49.200 --> 02:52.360 wouldn't expect to see anything in green here where it actually stopped the 54 02:52.360 --> 02:56.360 traffic. It also includes the signature ID that was matched on the signature 55 02:56.360 --> 03:00.120 revision and also information about the technique and the tactic we can click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 02:56.360 --> 03:00.120 revision and also information about the technique and the tactic we can click 56 03:00.120 --> 03:00.200 on 57 03:00.200 --> 03:03.240 these hyperlinks to get more information on those. So we click here on network 58 03:03.240 --> 03:07.200 shared discovery that opens up a new window with more details regarding that 59 03:07.200 --> 03:10.920 type of an attack. So if we brought these others back in as well it would then 60 03:10.920 --> 03:14.680 show us all the information regarding any of those that were applicable. So 61 03:14.680 --> 03:17.640 here we have some high if we continue scrolling down we have some they're 62 03:17.640 --> 03:21.680 suspicious if we expand that again I'll give us more details on where it was 63 03:21.680 --> 03:26.520 identified the hosts involved and also the action that was taken and links to 64 03:26.520 --> 03:29.280 more information.