Scribd
Upload
8 views2 pages

Logrhythm Na Logrhythm Netmon Data Sheet

Uploaded by

tx
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
8 views2 pages

Logrhythm Na Logrhythm Netmon Data Sheet

Uploaded by

tx
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Data Sheet

LogRhythm NetMon

Reveal Threats with Network Data


Security teams need visibility into their organization’s networks to detect Unified Security Intelligence
threats, perform forensic investigations, support audits, and identify LogRhythm NetMon is available as a
operational issues. Because cyberattacks are often first observed within the standalone network forensics solution or as a
network itself, network monitoring plays an essential role in helping detect, component of the LogRhythm SIEM platform.
neutralize, and recover from attacks. The integrated solution delivers:

LogRhythm NetMon delivers more detailed network visibility than • Security analytics across a centralized
nextgeneration firewalls, IDS/IPS systems, and other common network data set for corroborated evidence
equipment. The rich data and deep insights delivered by NetMon help chaining, including:
organizations detect and respond to advanced threats, including nation-state
- All machine data generated by
espionage, zero-day malware, and data exfiltration. Out-of-band deployment
the environment
prevents any impact on network device capacity and performance.
- Host activity captured by

Detect Advanced Threats endpoint sensors

- Layer 7 application flow and packet


Detect advanced threats with market-leading application recognition,
data captured by LogRhythm NetMon
script-based analytics across network and application data, and rich data
for centralized scenario-based analytics. With NetMon, you can: • Analysis of sensor data to detect critical
anomalies indicative of spear phishing,
• Recognize data theft, advanced malware, botnet beaconing,
lateral movement, and suspicious
inappropriate network usage, and other threats.
file transfers
• Corroborate high-risk events observed at the network and application
• Centralized search and visualization to
level with environmental activity collected by the SIEM.
expedite investigations, and contextual
• Create powerful custom analysis rules to alert on advanced threats.
access to session-based PCAPs
• Act on hundreds of attributes, including individual application,
• Embedded security orchestration,
application family, SSL information, IP address, and more.
automation, and response
(SOAR) function
Empower Incident Responders Powerful Capabilities
NetMon provides the option to capture and store session- True Application Identification: Expedite network
based PCAPs selectively or in full. The product provides forensics by automatically identifying and categorizing
out-of-the-box application identification and application- traffic from over 3,300 applications using deep packet
specific metadata. NetMon further enables your incident inspection (DPI) and advanced classification methods.
response team with unstructured search, session playback,
Metadata Generation: Leverage NetMon-generated
and file reconstruction.
SmartFlow™ metadata revealing Layer 2–7 details to
• Determine incident scope and exactly which data enable automated analysis, provide rich data for effective
and systems have been compromised. investigation, and support automated response — all
• Generate irrefutable network-based evidence for without packet analysis or significant storage requirements.
threat analysis, policy enforcement, audit support, Deep Packet Analytics (DPA): Automate threat detection
and legal action. by continuously correlating against full packet payload
• Reconstruct files transferred across networks to and SmartFlow™ metadata with out-of-the-box,
investigate suspected data exfiltration, malware customizable scripts.
infiltration, and unauthorized data access.
Unstructured Search: Perform ad hoc analysis. Drill down
to critical flow and packet data. With our Elasticsearch
Support Auditing and Operations backend, you have a powerful search engine to streamline
NetMon captures and analyzes data to help your investigation.
resolve operational issues and meet audit
Full Packet Capture: Empower your incident responders
and compliance requirements:
by capturing every bit crossing your network in industry
• Alert on policy violations and workarounds. standard PCAP format.
• Detect bandwidth bottlenecks and other
SmartCapture™: Programmatically capture sessions based
performance issues.
on application or packet content to drastically reduce your
• Identify compliance issues like exposed PII, storage requirements while preserving the information
plain text passwords, and outdated protocols. you need.

Flexible Deployment Options Packet Replay: Replay previously captured packets


through NetMon for deeper analysis. Replay traffic
NetMon sensors deploy via TAP, SPAN, or integration manually or automatically through the NetMon REST API.
with a third-party network packet broker. NetMon begins
analyzing traffic and recognizing applications immediately Alerts and Dashboards: Perform continuous analysis
upon installation. SmartFlow can be forwarded to an via saved searches to immediately detect when specific
analytics platform for further analysis. conditions are met, then surface alerts on customizable
monitoring dashboards.
• Physical appliances provide significant scalability
in a purposebuilt form factor. SIEM Integration: Empower analysis and administrators
by integrating with third-party analysis and orchestration
• Software-based NetMon provides a cost-effective
tools via REST APIs providing direct access to session-
choice for monitoring low-bandwidth sites, such as
based PCAPs and reconstructed files.
remote locations.
• Virtual sensors illuminate activity on cloud
infrastructure and virtual environments.

[email protected] // 1.866.384.0713 // +44 (0)1628 918 330 // +65 6222 8110 // +61 2 8019 7185 www.logrhythm.com
© LogRhythm Inc. | DS217823-04

You might also like