NetFlow

Baseline humans before sizing AI.

30 days of NetFlow or IPFix at the core and edge replaces every default in this paper with your own numbers.

2.

Score each constrained link per direction.

Um, I realized, uh, that detecting and troubleshooting, um, user-reported outages, which then sometimes were real outages, sometimes were not, um, sometimes the user had a better viewing to the network performance and the status of the applications than the monitoring tools that, uh, the average enterprise uses.

And so we decided to, um, you know, flip the script and monitor the network from the user perspective instead of from the kinda network perspective to really complement the information that tools like SNMP or NetFlow tools, uh, give us about the performance of the network and the applications.

And by focusing on the end user perspective, you have a pretty broad scope of endpoints, right? You- you're wired, wireless.

Tell us a little bit about, like, what's in scope for what you're wa- what you're looking at.

So we exist at the intersection of networking and security.

So what we did is provide the model with different forms of network-derived data, starting from NetFlow, which is the, um...

It's widely available, and it's cheap to acquire, and it's better than nothing, but it's quite, um, reduced.

It's a very reduced summary of what happens on, on the network.

And we even took care to make sure that our data was not configured optimally, so we didn't use all of our detections or all of our ML packages.

And what we discovered when we did that was vast material differences in outcomes.

So if we look at, at the capture the flag questions, the number that could be answered, with the NetFlow, that number might be in the mid-20%, which is a failing score.

If you're doing an investigation-

Detective controls are like watchtowers scanning for intruders, identifying the breaches as they occur, right? Real-time monitoring.

So IDS, Splunk, NetFlow, UBA, this is all, this is all, uh, examples of detective controls.

Corrective controls are contingency plans, so the processes that help to recover quickly if a breach occurs.

So automated response systems, backups, disaster recovery protocol, applying patches, resetting credentials, all of that is corrective.

Just one of those stories that sounds great.

You have sec- head of security at a company, their network's having a problem, their enterprise network, it's a bank in Canada, and they're getting, like, there's these floods across their network, and they go pull up their NetFlow logs, and it turns out, like, every machine in the bank is getting hammered.

Tons of data that are coming down from two machines on the internet, right? So what does, what does a, a great security person do is like, "Well, my network's not working.

Clearly there's some weird DOS going on." Blocks those two machines.

I think Joe has indelibly put that there.

So, your organization suspects an attacker is using some new techniques that don't match any of the existing IDS IPS signatures, but You have NetFlow data, you have the DNS logs, you have authentication logs, and you have endpoint telemetry.

So what's your research strategy for beginning to figure out how to craft a new IDS or IPS signature for this?

Well, you put a lot of emphasis on endpoint, so maybe I'll start there.

for local traffic uh internal to the network but yeah what was your network sensor

Yeah.

You said NetFlow, right?

Yes.

We talked about the dependency mapping piece of segmentation.

Like you have to map the dependencies before you can segment the application, right? But mapping the dependencies is really, really hard, right? Like my team would have to look at a ton of NetFlow in order to figure out how to map those dependencies out.

That might take days or weeks to do that.

But if I have a machine doing that work, an agent doing that work, that work might happen overnight or in a matter of minutes.