The network and supporting infrastructure have so much to tell you—if only you knew how to ask: What’s connected? Who is talking? What are they saying? The growing number and variety of devices and applications across today’s hybrid IT environment are becoming increasingly difficult to manage — whether related to IoT, SD-WAN, cloud migrations, or remote users at the network edge making answering these questions more urgent.
Observer GigaFlow to the rescue by combining network, infrastructure, and user data into a single enriched flow record captured and retained over time. Combining mountains of unstructured data provides in-depth details on network device types, connectivity, traffic control, and usage patterns. This information is maintained at the individual user/host, over time across all communication traversing the environment from any point of view making it particularly valuable for NetOps and SecOps teams when they are investigating anomalies activity.
With the release of Observer v18, enriched flow data from GigaFlow and packet-level wire data from GigaStor now coexist in Observer Apex. This means all levels of expertise have access to comprehensive views of performance and threat landscapes across their environments, using preferred data sources for QoS measurements, baselining, capacity planning, and more. This single, integrated interface improves operational efficiencies through boosted data quality, intuitive visualizations, and simplified workflows for any level of IT user.
VIAVI brings the network to the table and exposes the infrastructure and traffic clearly to all business stakeholders serving as the go-to platform for every IT team.
Feature and Benefit Summary:
- End-user experience and infrastructure insights provide situational awareness for stakeholders driving better decisions for tuning service delivery and assessing security challenges
- High-fidelity forensic visibility into network conversations over time supporting investigations reduces mean time to resolution
- Advanced service path visibility ensures immediate problem domain isolation across hybrid IT environments
- Automated threat assessment strengthens defense through immediate identification of rogue activity and unauthorized devices
- Cloud and virtual device insight deliver real-time understanding of performance in virtual, cloud, and remote environments
- An interactive IP Viewer that visualizes relationships between User, IP, MAC, and application usage in the network.
- A new, easy wizard-driven configuration method for Threat Profiles allows you to quickly and confidently define the hosts and services you want to monitor for suspicious traffic patterns
Network Forensics – Enriched Flow
By compiling Layer 2 to Layer 3 insights into a single enriched flow record, Observer can produce unique, interactive visualizations that illustrate the relationships between User, IP, MAC, and application usage in the network. A NetOps or SecOps user can simply enter a name enter in a username and immediately find all devices, interfaces, and applications associated with it. Finding out what is connected and who is communicating across your network has never been easier.
Wizard-Driven Threat Profiling
A new, easy wizard-driven configuration method for Threat Profiles allows you to quickly and confidently define the hosts and services you want to monitor for suspicious traffic patterns. Real-time alarms alert if traffic outside of the allowed patterns is detected, reducing or eliminating altogether false positives that can obscure real issues and waste resources.
End-User & Application Capacity Management
GigaFlow provides network traffic visibility on a per interface basis down to the layer 2 switch. Gain usage and utilization insight by individual user or in aggregate spanning the service delivery environment from core to edge and into the cloud. This is ideal for general assessments of end-user experience at points anywhere along the conversation route, and valuable for quantifying asset cost/benefit efficiencies. For example, assessing the cost effectiveness of cloud deployments and accurately attributing costs of underlying IT assets to the resource users (e.g. department, business unit).
Enriched Flow Forensics
GigaFlow offers real-time and long-term historical perspectives of end-user status and device as a function of underlying service health at every network traffic interface. The enriched flow records of GigaFlow dynamically capture all relevant data including timestamp and location continuously over extended periods. Because of this, IT teams can navigate to a specific event or anomaly in the past to troubleshoot and solve the problem by answering who it impacted and when, where, and how the incident occurred.
Threat ID with Scope & Impact Context
Out of the box, GigaFlow will automatically call home to obtain the latest black lists IPs, then checks it against all enriched flow records over time. GigaFlow can also alert on syn only flow records, often associated with rogue activity. Incidents from other security solutions can be passed to GigaFlow providing search and identification capabilities. This helps answer questions like: What was the host or device communicating with earlier? Where is the rogue host/device now? Who was using the host/device? This aids SecOp teams in their investigations and enhances existing security solutions.
Host/Device Traffic Profiling
A core capability of GigaFlow is the ability to build a traffic profile of hosts/devices on the network. Hosts are characterized by type, usage, application, and communication activity. This can be used to assess acceptable usage (e.g. white lists). Profiles are maintained in real-time with all future network generated device traffic evaluated against past behavior for unusual or anomalous activity. Ongoing SNMP polling has the added benefit of quickly detecting new and possibly rogue activity.
GigaFlow offers an extensible, easy deployment clustered architecture with carrier grade scalability and a “pay-as-you-grow” pricing model. Options are available as an appliance and in various software capacities based on number of flows supported and emitting sources to satisfy the needs of any size organization.
It integrates with Apex and GigaStor via workflows providing enriched flow record data for fast end-user experience troubleshooting and forensic security analysis.
The GigaFlow appliance is a 2U form factor capable of supporting up to 100,000 flows per second for each instance. For more details please refer here.
The GigaFlow software provides multiple options to support a range of flow rates. For more details please contact a VIAVI Solutions sales expert.
ObserverONE is VIAVI’s enterprise NPMD tool to empower IT teams to gain the powerful security and performance insights of the entire Observer platform all in one box. This upgradable appliance combines Apex’s superior end-user experience with GigaStor’s industry leading packet capture and GigaFlow’s enriched flow analysis, offering optimal performance at a modest price point with minimal footprint.