WEBVTT 1 00:00.000 --> 00:03.360 So a funny thing happened on the way to this video. 2 00:03.360 --> 00:06.400 Between this video and the previous one, it's been two days. 3 00:06.400 --> 00:11.040 And what happened was I was going to enable all the features in the NSX 4 00:11.040 --> 00:12.320 application platform. 5 00:12.320 --> 00:16.190 And when I did in my little nested environment, it totally had a fit and wasn't 6 00:16.190 --> 00:16.960 responding. 7 00:16.960 --> 00:20.480 So I actually redeployed the entire thing again. 8 00:20.480 --> 00:24.640 And this time I applied it to a cluster where I had four hosts with HA. 9 00:24.640 --> 00:28.640 And I gave each of those ESXI hosts tons and tons of resources. 10 00:28.640 --> 00:32.400 So if we open up the namespace here and I go to the VM and templates view WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:28.640 --> 00:32.400 So if we open up the namespace here and I go to the VM and templates view 11 00:32.400 --> 00:34.560 and open up the namespace and the cluster. 12 00:34.560 --> 00:38.080 So on this deployment, I said, you know what, I've got plenty of resources. 13 00:38.080 --> 00:42.400 Let's go ahead and do the full blown implementation with all the bells and 14 00:42.400 --> 00:43.360 whistles, 15 00:43.360 --> 00:46.960 with three separate workers and three separate control plane VMs. 16 00:46.960 --> 00:51.100 And then when I went back to the NSX Manager, let's go there right now, I went 17 00:51.100 --> 00:51.840 to system 18 00:51.840 --> 00:54.800 and I clicked on the NSX application platform. 19 00:54.800 --> 00:58.160 It looks like a few additional nodes here and then under the features. 20 00:58.160 --> 01:01.420 So I enabled each one of them, including NSX intelligence, which we've had a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 20 00:58.160 --> 01:01.420 So I enabled each one of them, including NSX intelligence, which we've had a 21 01:01.420 --> 01:02.400 previous 22 01:02.400 --> 01:03.760 set of videos on. 23 01:03.760 --> 01:08.480 And the NSX malware prevention enabled that again because I had to rebuild it. 24 01:08.480 --> 01:12.160 And I also enabled the NSX network detection and response. 25 01:12.160 --> 01:15.640 So let's take a moment and just do a quick recap of these features with NSX 26 01:15.640 --> 01:16.720 Intelligence. 27 01:16.720 --> 01:20.880 It gives us visibility into our workflows and our network traffic 28 01:20.880 --> 01:23.520 and can make recommendations on improving our security. 29 01:23.520 --> 01:26.160 And to look at that, we went to plan and troubleshoot. 30 01:26.160 --> 01:29.360 And then on the left, under discover and plan, we clicked right here and 31 01:29.360 --> 01:30.800 discover and take action. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:29.360 --> 01:30.800 discover and take action. 32 01:30.800 --> 01:32.640 That gave us some beautiful graphics. 33 01:32.640 --> 01:35.440 And then if we wanted to go ahead and for example, and click right here in our 34 01:35.440 --> 01:35.920 servers, 35 01:35.920 --> 01:39.370 right click and click on start recommendations, it would make some 36 01:39.370 --> 01:40.640 recommendations based on the 37 01:40.640 --> 01:44.720 traffic that it's seeing to go ahead and apply better security policies. 38 01:44.720 --> 01:47.770 So I just added the clients group there as well, like we did in our previous 39 01:47.770 --> 01:48.080 demos, 40 01:48.080 --> 01:49.840 and I'll click on start discovery. 41 01:49.840 --> 01:51.440 So that'll take a couple minutes to do it. 42 01:51.440 --> 01:55.560 And when it's done, we can view the recommendations here in the recommendations 43 01:55.560 --> 01:55.760 tab, 44 01:55.760 --> 01:59.360 which is under plan and troubleshoot and just one level down right here below, 45 01:59.360 --> 02:00.880 discover and take action. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 45 01:59.360 --> 02:00.880 discover and take action. 46 02:00.880 --> 02:02.240 And that's recommendations. 47 02:02.240 --> 02:06.480 So I have a recommendation that I created earlier and I published it. 48 02:06.480 --> 02:10.320 And I've got this additional recommendation that we just requested on its way. 49 02:10.320 --> 02:11.920 So it'll go from waiting. 50 02:11.920 --> 02:14.720 And then after a little bit of time, click on refresh. 51 02:14.720 --> 02:16.080 It'll show that it's processing. 52 02:16.080 --> 02:18.960 And then when it's done, we can view and apply those recommendations. 53 02:18.960 --> 02:22.880 And again, that's courtesy of the VMware NSX Intelligence. 54 02:22.880 --> 02:25.520 The other thing that NSX Intelligence brings to the table 55 02:25.520 --> 02:28.640 is that if we go to security and then a threat event monitoring, 56 02:28.640 --> 02:30.560 we click right here on suspicious traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 56 02:28.640 --> 02:30.560 we click right here on suspicious traffic. 57 02:30.560 --> 02:33.840 If we enable one or more of these detector definitions, 58 02:33.840 --> 02:37.400 it can go ahead and pay attention to that type of traffic and generate events 59 02:37.400 --> 02:37.840 for us. 60 02:37.840 --> 02:40.720 So if we click here on events, I don't have anything in the last hour, 61 02:40.720 --> 02:44.320 but if I go back, for example, last 12 hours, I've got an event right there. 62 02:44.320 --> 02:48.000 It looks based on the clock like it was 1 a.m. 63 02:48.000 --> 02:51.360 And I wish my clock was off, but that really is when I am. 64 02:51.360 --> 02:52.720 I'm pulling a half-nighter. 65 02:53.440 --> 02:56.470 I've opened up where I can't really do it all night, but I can certainly do a 66 02:56.470 --> 02:57.360 half-nighter. 67 02:57.360 --> 03:00.080 So again, that's courtesy of the NSX Intelligence. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 02:57.360 --> 03:00.080 So again, that's courtesy of the NSX Intelligence. 68 03:00.080 --> 03:03.680 And then if we want to set up IDS and IPS, as we did in a previous skill, 69 03:03.680 --> 03:06.560 once we've set the rules for that, we can see the events for that as well. 70 03:06.560 --> 03:11.760 And the IDS/IDS component isn't reliant on the NSX application platform, 71 03:11.760 --> 03:14.900 but it kind of goes in that same family of being aware of what's happening on 72 03:14.900 --> 03:15.600 the network. 73 03:15.600 --> 03:18.640 And here on the security tab, if we click on security overview, 74 03:18.640 --> 03:22.080 among other things we have a tab for the IDS/IPS right here, 75 03:22.080 --> 03:25.120 which is pretty handy to give us a bird's-eye view of what's happening. 76 03:25.120 --> 03:28.320 We have one for FQDN analysis and URL filtering. 77 03:28.320 --> 03:32.560 So this is showing from a database of malicious IPs provided by VMware WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 77 03:28.320 --> 03:32.560 So this is showing from a database of malicious IPs provided by VMware 78 03:32.560 --> 03:34.080 that we have had a computer. 79 03:34.080 --> 03:36.160 In fact, it was this one right here I was playing with earlier, 80 03:36.160 --> 03:39.200 which is a Linux Mints computer here on the 1055 network, 81 03:39.200 --> 03:42.640 which was accessing known malicious IPs. 82 03:42.640 --> 03:45.120 And as a result, that traffic was being blocked. 83 03:45.120 --> 03:50.000 So we're preventing those bad IP addresses from being reached by the client. 84 03:50.000 --> 03:53.280 So here in the security overview section, we simply go to the tab where we all 85 03:53.280 --> 03:53.840 look at the data. 86 03:53.840 --> 03:58.440 Now, the question is, how do we get like a really big picture view of what's 87 03:58.440 --> 03:59.440 really happening 88 03:59.440 --> 04:01.360 and correlating a whole bunch of different events? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 88 03:59.440 --> 04:01.360 and correlating a whole bunch of different events? 89 04:01.360 --> 04:05.200 Maybe we have some that are IDS/IPS, we have some that are malware, 90 04:05.200 --> 04:07.040 we have some that's suspicious traffic. 91 04:07.040 --> 04:10.080 How do we correlate that all into one place? 92 04:10.080 --> 04:13.200 As opposed to having to jump around to all the individual spots right here 93 04:13.200 --> 04:14.720 instead of the NSX manager. 94 04:14.720 --> 04:19.520 And the answer to that question is the additional tile inside of the NSX 95 04:19.520 --> 04:21.040 application platform. 96 04:21.040 --> 04:23.280 And that tile is right here. 97 04:23.280 --> 04:27.200 That is the NSX network detection and response. 98 04:27.200 --> 04:30.880 Now, all of these features that we're demonstrating in these sets of videos, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 98 04:27.200 --> 04:30.880 Now, all of these features that we're demonstrating in these sets of videos, 99 04:30.880 --> 04:34.880 I'm using with the licenses that I got as part of V-MUG Advantage. 100 04:34.880 --> 04:39.350 And as part of V-MUG Advantage, they provide you with access to evaluation 101 04:39.350 --> 04:40.560 licenses for 102 04:40.560 --> 04:43.280 a lot of their products that are good for one year. 103 04:43.280 --> 04:46.800 And the intention for those licenses is for you to build practice labs and do 104 04:46.800 --> 04:47.920 proof of concepts 105 04:47.920 --> 04:49.200 and build your skills. 106 04:49.200 --> 04:52.720 So, regarding this last tile right here, the NSX network detection and response 107 04:52.720 --> 04:52.720 , 108 04:52.720 --> 04:56.560 once it's been clicked on, it'll do a pre-check and then you go ahead and say 109 04:56.560 --> 05:01.120 activate it, once it's activated, we then can go ahead and up in this upper WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 109 04:56.560 --> 05:01.120 activate it, once it's activated, we then can go ahead and up in this upper 110 05:01.120 --> 05:01.520 right-hand 111 05:01.520 --> 05:05.440 corner right here, we can click there and then we can go over to a separate 112 05:05.440 --> 05:06.720 window just for 113 05:06.720 --> 05:09.120 NSX network detection and response. 114 05:09.120 --> 05:14.080 And this is a fantastic option that can send our threat alerts and all our data 115 05:14.080 --> 05:18.240 to the advanced threat prevention cloud services from VMware 116 05:18.240 --> 05:21.280 and give us a nice easy way to see everything that's going on. 117 05:21.280 --> 05:25.520 So, here's the dashboard, let me go ahead and change the time range to the last 118 05:25.520 --> 05:26.240 one day, 119 05:26.240 --> 05:30.080 because most of the activity I've done has been in the last 24 hours. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 119 05:26.240 --> 05:30.080 because most of the activity I've done has been in the last 24 hours. 120 05:30.080 --> 05:33.200 So, it has a list of active campaigns currently just have one. 121 05:33.200 --> 05:35.840 And we'll get to this in a little more detail in just a moment by clicking here 122 05:35.840 --> 05:36.480 on campaigns, 123 05:36.480 --> 05:37.680 but let's scroll down first. 124 05:37.680 --> 05:41.110 So, we have a network in security summary, nice beautiful graphical 125 05:41.110 --> 05:41.920 representation, 126 05:41.920 --> 05:43.360 detected threats. 127 05:43.360 --> 05:47.280 And if we scroll down, we have a global map, so I downloaded a little 128 05:47.280 --> 05:49.120 something malicious a little while ago. 129 05:49.120 --> 05:52.320 And when I downloaded, I downloaded one of them from Germany and the other one 130 05:52.320 --> 05:52.960 right here 131 05:52.960 --> 05:54.720 from looks like Russia. 132 05:54.720 --> 05:58.480 And that was an intentional, I just was doing a search and download some files 133 05:58.480 --> 05:59.600 and test files, 134 05:59.600 --> 06:02.480 and that happened to be where the servers were that I got them from. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 134 05:59.600 --> 06:02.480 and that happened to be where the servers were that I got them from. 135 06:02.480 --> 06:05.840 If we scroll down, it has details regarding new unique detections. 136 06:05.840 --> 06:09.490 And if there was malware that had been seen, and if we had set up our system 2 137 06:09.490 --> 06:10.240 capture, 138 06:10.240 --> 06:13.840 either suspicious or known malware, we can see this in a list right here. 139 06:13.840 --> 06:17.580 So, let's go back up to the top and let's go ahead and take a look at campaigns 140 06:17.580 --> 06:17.840 . 141 06:17.840 --> 06:22.240 Again, this is part of the NSX network detection and response. 142 06:22.240 --> 06:25.840 So, here's my current ongoing campaign, I'll go ahead and click on it. 143 06:25.840 --> 06:29.390 So, across the top, I have an overview that hosts in timeline history, evidence 144 06:29.390 --> 06:29.440 , 145 06:29.440 --> 06:31.040 and then here are the attack stages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 145 06:29.440 --> 06:31.040 and then here are the attack stages. 146 06:31.040 --> 06:34.880 So, there's the delivery, exploitation, command and control. 147 06:34.880 --> 06:38.640 So, when this threat showed up, it was associated at this level of the attack 148 06:38.640 --> 06:38.880 stage, 149 06:38.880 --> 06:40.080 the command and control. 150 06:40.080 --> 06:42.560 And then if we scroll down, there's a beautiful graphic. 151 06:43.200 --> 06:45.280 And I'll go ahead and make this a little bit bigger. 152 06:45.280 --> 06:47.200 So, this is a graphic just representing what happened. 153 06:47.200 --> 06:51.840 So, there was the machine I was working from, there's the system I got it from, 154 06:51.840 --> 06:55.680 and this could help us track where that virus is showing up in our topology. 155 06:55.680 --> 06:58.240 So, if this machine was compromised, and then there was a pivot done, 156 06:58.240 --> 07:02.210 and then the attacker or the software during the attacking started making its WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 156 06:58.240 --> 07:02.210 and then the attacker or the software during the attacking started making its 157 07:02.210 --> 07:02.640 way further 158 07:02.640 --> 07:06.160 in the network, this could visually help us see where that compromise has taken 159 07:06.160 --> 07:06.560 place. 160 07:06.560 --> 07:09.440 So, if we go back up to the top, we can click on host right here. 161 07:09.440 --> 07:13.120 So, there was the host involved, and then there's a tab here for history. 162 07:13.120 --> 07:15.040 And a tab for evidence. 163 07:15.040 --> 07:18.840 So, if we expand this, it gives us more details on that compromise or that 164 07:18.840 --> 07:20.000 attempted compromise. 165 07:20.000 --> 07:22.160 And so, here on the left, we're going to have a lot more of the same 166 07:22.160 --> 07:22.720 information, 167 07:22.720 --> 07:24.000 just sorted a little bit differently. 168 07:24.000 --> 07:27.280 So, if we click here on host, here we can click on host with threats to just 169 07:27.280 --> 07:27.920 see those, 170 07:27.920 --> 07:31.120 or open high impact threats, see just those. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 170 07:27.920 --> 07:31.120 or open high impact threats, see just those. 171 07:31.120 --> 07:34.170 And one of the cool things about this is that there's so many hyperlinks 172 07:34.170 --> 07:34.400 involved. 173 07:34.400 --> 07:37.680 For example, this host right here, 1055 0151. 174 07:37.680 --> 07:40.830 If you wanted to know more about that, we can just click on that individual 175 07:40.830 --> 07:41.200 host. 176 07:41.200 --> 07:45.100 So, here's the overview, we can go to the threats we're in that host, and 177 07:45.100 --> 07:46.160 events regarding that 178 07:46.160 --> 07:46.720 host. 179 07:46.720 --> 07:49.960 So, there's the Germany and Russian flags representing the source of where I 180 07:49.960 --> 07:51.200 downloaded those from. 181 07:51.200 --> 07:54.880 And if we go back to overview, there's also a link right here regarding the VM, 182 07:54.880 --> 07:58.240 where we could view that VM in the inventory insight NSX manager. 183 07:58.240 --> 08:00.800 So, it's taking us back over to NSX manager. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 183 07:58.240 --> 08:00.800 So, it's taking us back over to NSX manager. 184 08:00.800 --> 08:02.480 Effectively, it's just another tab. 185 08:02.480 --> 08:04.720 And this is just a little reminder regarding the app switcher, 186 08:04.720 --> 08:09.280 this little widget up here on the top right that we can use to go between the 187 08:09.280 --> 08:10.960 NSX advanced load balancer, 188 08:11.280 --> 08:14.800 the network detection and response, and also cloud services manager. 189 08:14.800 --> 08:16.640 Should we be using any of those services? 190 08:16.640 --> 08:17.760 So, I'll say got it. 191 08:17.760 --> 08:21.440 And then here is that virtual machine that had the attacks. 192 08:21.440 --> 08:23.760 So, if we want to go back to the network detection and response, 193 08:23.760 --> 08:27.440 we could go ahead and go to the previous tab, or we could just click up here, 194 08:27.440 --> 08:29.360 and it'll open up a new tab for us. 195 08:29.360 --> 08:32.480 So, on the left, if we go down to events, here are the events. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 195 08:29.360 --> 08:32.480 So, on the left, if we go down to events, here are the events. 196 08:32.480 --> 08:36.320 We have another option here for instance, and then a section for file download, 197 08:36.320 --> 08:38.320 and also down here for alert management. 198 08:38.320 --> 08:41.680 And in the event that we did capture some files based on our configuration, 199 08:41.680 --> 08:45.280 there's an option right here for a nice centralized location for files 200 08:45.280 --> 08:45.840 downloaded, 201 08:45.840 --> 08:47.520 where we can look and sort through those. 202 08:47.520 --> 08:51.200 So, again, the network detection and response is a fantastic option. 203 08:51.200 --> 08:56.160 As part of the NSX application platform, to have kind of a one-stop shop for 204 08:56.160 --> 08:57.520 visualization 205 08:57.520 --> 08:59.920 and correlation of our network events.