WEBVTT

1
00:00.000 --> 00:04.970
Now, when it comes to suspicious or possibly malicious traffic on our networks,

2
00:04.970 --> 00:05.080
there's

3
00:05.080 --> 00:06.720
only two types of networks.

4
00:06.720 --> 00:10.780
Networks that have had that type of traffic or networks that will have that

5
00:10.780 --> 00:11.880
type of traffic.

6
00:11.880 --> 00:15.770
And when it comes to malicious and/or suspicious traffic, we absolutely, if we

7
00:15.770 --> 00:16.960
have the ability,

8
00:16.960 --> 00:19.520
we want to know about it that it's happening.

9
00:19.520 --> 00:23.800
And that is one of the features that NSX Intelligence brings to the table.

10
00:23.800 --> 00:28.060
Now to facilitate the detection of suspicious traffic, we first of all need to

11
00:28.060 --> 00:28.640
enable that

12
00:28.640 --> 00:29.640
feature.

13
00:29.640 --> 00:33.430
In the way that we've enabled the NSX Intelligence, we did that by going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.640 --> 00:33.430
In the way that we've enabled the NSX Intelligence, we did that by going to

14
00:33.430 --> 00:34.280
System, then going

15
00:34.280 --> 00:37.800
to the NSX Application Platform over here on the left, and then here in the

16
00:37.800 --> 00:38.320
main pane

17
00:38.320 --> 00:42.360
for the NSX Application Platform, we scroll down and we enabled NSX

18
00:42.360 --> 00:43.520
Intelligence.

19
00:43.520 --> 00:47.900
So even though we've done that, we also need to enable the specific detectors

20
00:47.900 --> 00:48.480
if we're

21
00:48.480 --> 00:51.400
going to use the detection of suspicious traffic.

22
00:51.400 --> 00:54.880
So to do that additional step, we're going to go back here to Security.

23
00:54.880 --> 00:58.230
And with Security selected, we're going to go down to Suspicious Traffic right

24
00:58.230 --> 00:58.520
here

25
00:58.520 --> 01:00.600
under Threat Event Monitoring.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.520 --> 01:00.600
under Threat Event Monitoring.

26
01:00.600 --> 01:02.520
So we'll click here on Suspicious Traffic.

27
01:02.520 --> 01:05.780
So here with Suspicious Traffic selected, it gives us under the Events tab

28
01:05.780 --> 01:06.440
right here,

29
01:06.440 --> 01:09.640
an overview regarding the last by default hour.

30
01:09.640 --> 01:12.280
We could also change that regarding suspicious activity.

31
01:12.280 --> 01:16.880
But by default, nothing is going to show up here because the detectors are not

32
01:16.880 --> 01:17.480
enabled

33
01:17.480 --> 01:18.480
by default.

34
01:18.480 --> 01:20.960
So one might ask, well, why are these all disabled by default?

35
01:20.960 --> 01:22.400
The one I want to turn them all on.

36
01:22.400 --> 01:26.210
Well, if we have them all on, it's going to take additional resources, CPU and

37
01:26.210 --> 01:26.880
so forth,

38
01:26.880 --> 01:27.880
to make it happen.

39
01:27.880 --> 01:31.200
So you can enable them, but they're off by default.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:27.880 --> 01:31.200
So you can enable them, but they're off by default.

40
01:31.200 --> 01:33.880
So let's take a look at a few of these as an example.

41
01:33.880 --> 01:35.800
Here's the Horizontal Port Scan.

42
01:35.800 --> 01:39.330
Or an intruder tries to scan one or more ports or services across multiple

43
01:39.330 --> 01:39.920
systems.

44
01:39.920 --> 01:43.320
They're trying to do a, for example, a sweep of hosts and ports.

45
01:43.320 --> 01:44.480
So it's not enabled by default.

46
01:44.480 --> 01:46.440
So we can click here on the pencil and say, you know what?

47
01:46.440 --> 01:47.760
I want to enable it.

48
01:47.760 --> 01:50.560
And then we can specify how tolerant we want it to be.

49
01:50.560 --> 01:54.270
So I'm going to go ahead and for the demo, I'm going to set it all the way to a

50
01:54.270 --> 01:54.400
one,

51
01:54.400 --> 01:56.880
which is more likely to some false positives.

52
01:56.880 --> 01:59.880
But for the demo, I'll be sure to capture any scans that I'm doing.

53
01:59.880 --> 02:01.480
So then I'll go ahead and save it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.880 --> 02:01.480
So then I'll go ahead and save it.

54
02:01.480 --> 02:03.080
And we also have an option of setting up a filter.

55
02:03.080 --> 02:04.240
We go back to edit here.

56
02:04.240 --> 02:09.440
We can also exclude certain devices, so we can exclude a group or specific BMs

57
02:09.440 --> 02:09.720
so that

58
02:09.720 --> 02:13.480
it won't pick up traffic based on it coming from those devices.

59
02:13.480 --> 02:15.600
So I'm going to leave the Horizontal Port Scan enabled.

60
02:15.600 --> 02:16.600
And let's grab one more.

61
02:16.600 --> 02:18.320
Let's go down to a vertical port scan.

62
02:18.320 --> 02:21.320
That's where somebody's doing a scan of an individual host.

63
02:21.320 --> 02:23.360
We'll click on the pencil to edit that.

64
02:23.360 --> 02:24.720
And let's go ahead and enable it.

65
02:24.720 --> 02:27.960
And I'm also going to sensitivity that to way, way low.

66
02:27.960 --> 02:29.880
And the number there is the confidence level.

67
02:29.880 --> 02:33.710
So the higher you set it, if this fires off as a match, it's going to be more
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:29.880 --> 02:33.710
So the higher you set it, if this fires off as a match, it's going to be more

68
02:33.710 --> 02:34.400
likely that

69
02:34.400 --> 02:37.320
that event is really happening versus if we put it all the way down here, which

70
02:37.320 --> 02:37.680
I'm going

71
02:37.680 --> 02:40.280
to do in my demo and we'll click on save.

72
02:40.280 --> 02:45.880
So at this point, I've just enabled two of these suspicious traffic detectors,

73
02:45.880 --> 02:46.280
one looking

74
02:46.280 --> 02:50.760
for a network scan and the other looking for a specific host scan.

75
02:50.760 --> 02:53.840
Although we could enable it on more, but those are the two that I can use to go

76
02:53.840 --> 02:54.160
ahead

77
02:54.160 --> 02:55.360
and do a demo.

78
02:55.360 --> 02:59.560
So now with those two detectors enabled, if we go to events, if any of those

79
02:59.560 --> 03:00.280
detectors
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:59.560 --> 03:00.280
detectors

80
03:00.280 --> 03:05.760
identify suspicious traffic, which would involve a host scan or a network scan,

81
03:05.760 --> 03:05.840
those

82
03:05.840 --> 03:09.210
results, if it happens in the last hour should be right here, we could also

83
03:09.210 --> 03:10.000
specify the time

84
03:10.000 --> 03:12.440
period we want to go ahead and show results for.

85
03:12.440 --> 03:14.880
So let's go ahead and demonstrate those detectors in action.

86
03:14.880 --> 03:17.400
So let me go ahead and bring in a client.

87
03:17.400 --> 03:22.720
So here is one of our Linux Mint computers on the 1055 network.

88
03:22.720 --> 03:25.080
And let me go ahead and close the browser.

89
03:25.080 --> 03:28.450
Let me also go ahead and stop our little script that was doing the curls over

90
03:28.450 --> 03:28.800
to our

91
03:28.800 --> 03:30.080
web servers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:28.800 --> 03:30.080
web servers.

92
03:30.080 --> 03:31.080
And let's run an end map.

93
03:31.080 --> 03:32.680
So currently I'm on the 1055 network.

94
03:32.680 --> 03:37.600
We'll do an IF config to confirm that and sure enough, 1055 0151.

95
03:37.600 --> 03:38.840
And let's do an end map.

96
03:38.840 --> 03:42.160
And let's go ahead and do a scan of our local network.

97
03:42.160 --> 03:46.720
And the dash P dash says I want to scan for all possible ports up to like 65,

98
03:46.720 --> 03:48.520
000 per host.

99
03:48.520 --> 03:54.830
And then I'm going to target that at my local network, which is 10.55.0.0 with

100
03:54.830 --> 03:55.680
a 24 bit

101
03:55.680 --> 03:57.360
mask will press enter.

102
03:57.360 --> 04:01.240
So that's now in motions, we can press enter and get status reports.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:57.360 --> 04:01.240
So that's now in motions, we can press enter and get status reports.

103
04:01.240 --> 04:04.360
So this has like a minute and 39 seconds remaining.

104
04:04.360 --> 04:06.080
And I'll continue to press enter.

105
04:06.080 --> 04:09.630
So I found two hosts and now is doing a port scan on those two hosted that

106
04:09.630 --> 04:10.600
found responsive

107
04:10.600 --> 04:15.480
and it's testing like 65,000 possible ports to see which ports are open.

108
04:15.480 --> 04:17.840
So in a moment here, it'll show us what's open.

109
04:17.840 --> 04:21.400
So we've got port 22 open on one host on this local network.

110
04:21.400 --> 04:24.600
I've got port 68, which is for a DHCP client.

111
04:24.600 --> 04:27.520
And I've also got port 80, which is HTTP.

112
04:27.520 --> 04:30.580
Now if we did that same thing again, but for the other network, let's go ahead
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:27.520 --> 04:30.580
Now if we did that same thing again, but for the other network, let's go ahead

113
04:30.580 --> 04:31.240
and target

114
04:31.240 --> 04:32.680
the 66 network.

115
04:32.680 --> 04:38.340
So that's just being routed over from the local 1055 segment over to the 1066

116
04:38.340 --> 04:38.920
network

117
04:38.920 --> 04:41.160
at which point is doing a ping sweep.

118
04:41.160 --> 04:44.830
And then it's going into each of the individual hosts doing an extensive port

119
04:44.830 --> 04:45.640
scan for those

120
04:45.640 --> 04:48.320
hosts that have found up and responsive with the ping sweep.

121
04:48.320 --> 04:51.520
So if we press enter, it'll give a status about what's going on.

122
04:51.520 --> 04:54.400
So still doing the ping sweep almost done with that.

123
04:54.400 --> 04:57.440
And then when that's done, it'll start doing the actual host scans.

124
04:57.440 --> 04:59.440
So the purpose here was just to generate some scans.

125
04:59.440 --> 05:02.980
Also, if we wanted to target a specific host, we could go ahead and do that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:59.440 --> 05:02.980
Also, if we wanted to target a specific host, we could go ahead and do that

126
05:02.980 --> 05:03.960
same command,

127
05:03.960 --> 05:06.840
except target 1066, 0.151 over there.

128
05:06.840 --> 05:11.480
We'll press enter and that's going to do a specific host scan to that target

129
05:11.480 --> 05:11.680
and we'll

130
05:11.680 --> 05:13.480
press enter to get status.

131
05:13.480 --> 05:14.880
It's about halfway done.

132
05:14.880 --> 05:18.360
Now, the whole purpose of that was to generate some traffic that we could see

133
05:18.360 --> 05:19.360
in these suspicious

134
05:19.360 --> 05:20.360
traffic outputs.

135
05:20.360 --> 05:24.070
So for the detector definitions, it's very likely that we've triggered this one

136
05:24.070 --> 05:24.400
right

137
05:24.400 --> 05:26.600
here, the horizontal port scan.

138
05:26.600 --> 05:27.960
So let's check it out.

139
05:27.960 --> 05:31.710
So if the security tab selected on the left, suspicious traffic selected, let's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:27.960 --> 05:31.710
So if the security tab selected on the left, suspicious traffic selected, let's

140
05:31.710 --> 05:32.080
click on

141
05:32.080 --> 05:35.720
the tab right here under suspicious traffic called events.

142
05:35.720 --> 05:37.440
And let's see what it's showing us.

143
05:37.440 --> 05:40.160
So for the last hour, we'll click on refresh.

144
05:40.160 --> 05:42.160
I'm not seeing anything quite yet.

145
05:42.160 --> 05:44.360
Again, it may take just a moment for that to show up.

146
05:44.360 --> 05:47.190
Now, what I can show you while we're waiting for that last attack to show up

147
05:47.190 --> 05:47.640
with that

148
05:47.640 --> 05:52.280
last suspicious traffic, we could go ahead and take a look at the last 24 hours

149
05:52.280 --> 05:52.840
because

150
05:52.840 --> 05:57.610
I also did a few tests about an hour and a half ago and that's showing up right

151
05:57.610 --> 05:58.240
here.

152
05:58.240 --> 05:59.240
So about 9 a.m.

153
05:59.240 --> 06:02.800
Local time, it identified these attacks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
05:59.240 --> 06:02.800
Local time, it identified these attacks.

154
06:02.800 --> 06:05.280
So two horizontal port scans.

155
06:05.280 --> 06:08.990
So we expand those here, it's showing us the source and the target and the

156
06:08.990 --> 06:10.440
targeted ports

157
06:10.440 --> 06:12.920
and the two targeted VMs.

158
06:12.920 --> 06:16.610
So against this machine at .151, which is one of our web servers, it was

159
06:16.610 --> 06:19.400
targeted port 38,386

160
06:19.400 --> 06:24.720
using TCP at layer four and 5,446 more.

161
06:24.720 --> 06:29.520
And then for the mint computer on the 1066 network for that VM, the targeted

162
06:29.520 --> 06:30.100
port was
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
06:29.520 --> 06:30.100
port was

163
06:30.100 --> 06:36.760
TCP port 63,379 and 4,947 more.

164
06:36.760 --> 06:38.200
So I'll go ahead and close that.

165
06:38.200 --> 06:41.700
And if we hover, it's going to show us the severity and also the confidence

166
06:41.700 --> 06:42.600
level regarding

167
06:42.600 --> 06:44.640
that being an accurate match.

168
06:44.640 --> 06:49.050
And I also do the attack again, but this time I did it from the 1066 mint VM

169
06:49.050 --> 06:49.400
going over

170
06:49.400 --> 06:50.800
to the 1055 network.

171
06:50.800 --> 06:52.440
So here's the details for that one.

172
06:52.440 --> 06:56.200
And then each of these are hyperlinks to give us more details on the ports

173
06:56.200 --> 06:57.120
involved and

174
06:57.120 --> 07:01.540
the VMs involved and also a little visual representation here about the source
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

174
06:57.120 --> 07:01.540
the VMs involved and also a little visual representation here about the source

175
07:01.540 --> 07:01.920
and the

176
07:01.920 --> 07:02.920
targets.

177
07:02.920 --> 07:06.050
Also in this suspicious traffic report here, if we click on this link for view

178
07:06.050 --> 07:06.560
affected

179
07:06.560 --> 07:10.530
VMs and their current traffic right here on the bottom right, that takes us

180
07:10.530 --> 07:10.920
back to the

181
07:10.920 --> 07:14.650
plan and troubleshoot, discover and take action so we can see exactly what's

182
07:14.650 --> 07:16.000
going on.

183
07:16.000 --> 07:19.820
And as a result of the scans I just did, there's a whole bunch of traffic and I

184
07:19.820 --> 07:20.160
don't

185
07:20.160 --> 07:24.440
know if you can notice, but it is all red, meaning unprotected.

186
07:24.440 --> 07:28.110
So we didn't have rules in place that either permitted or denied that traffic,

187
07:28.110 --> 07:28.640
but indeed

188
07:28.640 --> 07:30.480
those ping scans were allowed.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
07:28.640 --> 07:30.480
those ping scans were allowed.

189
07:30.480 --> 07:33.170
And if we look at the very center of this whole thing, it'd be the mint

190
07:33.170 --> 07:33.760
computer that

191
07:33.760 --> 07:35.440
I just launched it from right here.

192
07:35.440 --> 07:38.760
So we right click and then click on flow details.

193
07:38.760 --> 07:46.240
Here it has page one of 257 for a total whopping over 12,000 flows that it is

194
07:46.240 --> 07:47.440
aware of.

195
07:47.440 --> 07:49.360
And we can do it each one of these and take a look.

196
07:49.360 --> 07:53.360
And so as part of the default rules permitting anything to anywhere is showing

197
07:53.360 --> 07:54.000
us why that

198
07:54.000 --> 07:55.600
traffic is being allowed.

199
07:55.600 --> 07:59.020
So to prevent this type of traffic, we could go in and set up our rules

200
07:59.020 --> 07:59.880
ourselves on our

201
07:59.880 --> 08:03.490
street of firewalls or we could ask NSX intelligence to help us with some
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
07:59.880 --> 08:03.490
street of firewalls or we could ask NSX intelligence to help us with some

202
08:03.490 --> 08:04.640
recommendations.

203
08:04.640 --> 08:05.880
So I'll close that.

204
08:05.880 --> 08:10.920
Then we have one green line here as well, which indicates a protective flow.

205
08:10.920 --> 08:13.590
So we could right click on that and then look at the details for that

206
08:13.590 --> 08:14.480
protective flow.

207
08:14.480 --> 08:18.080
However, most of this traffic is bad news because it was just scanned.

208
08:18.080 --> 08:22.580
So let's go back to the security tab here and on the left under suspicious

209
08:22.580 --> 08:23.480
traffic.

210
08:23.480 --> 08:27.690
And let's take a look at the last hour and there is our attack that we launched

211
08:27.690 --> 08:28.120
right

212
08:28.120 --> 08:31.840
there and there is our suspicious traffic right there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

212
08:28.120 --> 08:31.840
there and there is our suspicious traffic right there.

213
08:31.840 --> 08:36.410
So if we go to the last 12 hours, that's the previous ones that I generated and

214
08:36.410 --> 08:37.080
this represents

215
08:37.080 --> 08:39.760
the scanning that we did just a moment ago.

216
08:39.760 --> 08:43.800
So if we click on the last one hour, that'll be the only one that shows up.

217
08:43.800 --> 08:47.230
And then we can go ahead and expand it to see more details about what was going

218
08:47.230 --> 08:47.600
on.

219
08:47.600 --> 08:49.880
So we have one source here.

220
08:49.880 --> 08:56.400
That's our little mint VM and the targets were the web server 10660151.

221
08:56.400 --> 08:59.780
Also the mint Linux machine over at 1066 caught a little bit of that as part of

222
08:59.780 --> 09:00.600
our scanning
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

222
08:59.780 --> 09:00.600
our scanning

223
09:00.600 --> 09:03.840
and also the web server at 10550152.

224
09:03.840 --> 09:08.740
So there were thousands of targeted ports on these three VMs and there they are

225
09:08.740 --> 09:09.200
right

226
09:09.200 --> 09:10.200
there.

227
09:10.200 --> 09:13.160
So we'll click on close and they'll go ahead and collapse that.

228
09:13.160 --> 09:17.000
So in this set of videos, we've taken a look at one of the features as part of

229
09:17.000 --> 09:18.040
the NSX application

230
09:18.040 --> 09:22.840
platform and that is the NSX intelligence which that component alone brings

231
09:22.840 --> 09:23.880
three major things

232
09:23.880 --> 09:24.880
to the table.

233
09:24.880 --> 09:28.080
Number one, it gives us a visualization of our traffic close.

234
09:28.080 --> 09:32.460
Number two, recommendations on improving our firewall policies to permit the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

234
09:28.080 --> 09:32.460
Number two, recommendations on improving our firewall policies to permit the

235
09:32.460 --> 09:33.120
traffic that

236
09:33.120 --> 09:34.400
we want to allow.

237
09:34.400 --> 09:38.600
And then third, by enabling detectors to be able to identify suspicious traffic

238
09:38.600 --> 09:38.840
on our

239
09:38.840 --> 09:39.360
networks.

240
09:39.360 --> 10:00.260
[ Pause ]