So a funny thing happened on the way to this video.
Between this video and the previous one, it's been two days.
And what happened was I was going to enable all the features in the NSX
application platform.
And when I did in my little nested environment, it totally had a fit and wasn't
responding.
So I actually redeployed the entire thing again.
And this time I applied it to a cluster where I had four hosts with HA.
And I gave each of those ESXI hosts tons and tons of resources.
So if we open up the namespace here and I go to the VM and templates view WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we open up the namespace here and I go to the VM and templates view
and open up the namespace and the cluster.
So on this deployment, I said, you know what, I've got plenty of resources.
Let's go ahead and do the full blown implementation with all the bells and
whistles,
with three separate workers and three separate control plane VMs.
And then when I went back to the NSX Manager, let's go there right now, I went
to system
and I clicked on the NSX application platform.
It looks like a few additional nodes here and then under the features.
So I enabled each one of them, including NSX intelligence, which we've had a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I enabled each one of them, including NSX intelligence, which we've had a
previous
set of videos on.
And the NSX malware prevention enabled that again because I had to rebuild it.
And I also enabled the NSX network detection and response.
So let's take a moment and just do a quick recap of these features with NSX
Intelligence.
It gives us visibility into our workflows and our network traffic
and can make recommendations on improving our security.
And to look at that, we went to plan and troubleshoot.
And then on the left, under discover and plan, we clicked right here and
discover and take action. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
discover and take action.
That gave us some beautiful graphics.
And then if we wanted to go ahead and for example, and click right here in our
servers,
right click and click on start recommendations, it would make some
recommendations based on the
traffic that it's seeing to go ahead and apply better security policies.
So I just added the clients group there as well, like we did in our previous
demos,
and I'll click on start discovery.
So that'll take a couple minutes to do it.
And when it's done, we can view the recommendations here in the recommendations
tab,
which is under plan and troubleshoot and just one level down right here below,
discover and take action. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
discover and take action.
And that's recommendations.
So I have a recommendation that I created earlier and I published it.
And I've got this additional recommendation that we just requested on its way.
So it'll go from waiting.
And then after a little bit of time, click on refresh.
It'll show that it's processing.
And then when it's done, we can view and apply those recommendations.
And again, that's courtesy of the VMware NSX Intelligence.
The other thing that NSX Intelligence brings to the table
is that if we go to security and then a threat event monitoring,
we click right here on suspicious traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we click right here on suspicious traffic.
If we enable one or more of these detector definitions,
it can go ahead and pay attention to that type of traffic and generate events
for us.
So if we click here on events, I don't have anything in the last hour,
but if I go back, for example, last 12 hours, I've got an event right there.
It looks based on the clock like it was 1 a.m.
And I wish my clock was off, but that really is when I am.
I'm pulling a half-nighter.
I've opened up where I can't really do it all night, but I can certainly do a
half-nighter.
So again, that's courtesy of the NSX Intelligence. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So again, that's courtesy of the NSX Intelligence.
And then if we want to set up IDS and IPS, as we did in a previous skill,
once we've set the rules for that, we can see the events for that as well.
And the IDS/IDS component isn't reliant on the NSX application platform,
but it kind of goes in that same family of being aware of what's happening on
the network.
And here on the security tab, if we click on security overview,
among other things we have a tab for the IDS/IPS right here,
which is pretty handy to give us a bird's-eye view of what's happening.
We have one for FQDN analysis and URL filtering.
So this is showing from a database of malicious IPs provided by VMware WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is showing from a database of malicious IPs provided by VMware
that we have had a computer.
In fact, it was this one right here I was playing with earlier,
which is a Linux Mints computer here on the 1055 network,
which was accessing known malicious IPs.
And as a result, that traffic was being blocked.
So we're preventing those bad IP addresses from being reached by the client.
So here in the security overview section, we simply go to the tab where we all
look at the data.
Now, the question is, how do we get like a really big picture view of what's
really happening
and correlating a whole bunch of different events? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and correlating a whole bunch of different events?
Maybe we have some that are IDS/IPS, we have some that are malware,
we have some that's suspicious traffic.
How do we correlate that all into one place?
As opposed to having to jump around to all the individual spots right here
instead of the NSX manager.
And the answer to that question is the additional tile inside of the NSX
application platform.
And that tile is right here.
That is the NSX network detection and response.
Now, all of these features that we're demonstrating in these sets of videos, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, all of these features that we're demonstrating in these sets of videos,
I'm using with the licenses that I got as part of V-MUG Advantage.
And as part of V-MUG Advantage, they provide you with access to evaluation
licenses for
a lot of their products that are good for one year.
And the intention for those licenses is for you to build practice labs and do
proof of concepts
and build your skills.
So, regarding this last tile right here, the NSX network detection and response
,
once it's been clicked on, it'll do a pre-check and then you go ahead and say
activate it, once it's activated, we then can go ahead and up in this upper WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
activate it, once it's activated, we then can go ahead and up in this upper
right-hand
corner right here, we can click there and then we can go over to a separate
window just for
NSX network detection and response.
And this is a fantastic option that can send our threat alerts and all our data
to the advanced threat prevention cloud services from VMware
and give us a nice easy way to see everything that's going on.
So, here's the dashboard, let me go ahead and change the time range to the last
one day,
because most of the activity I've done has been in the last 24 hours. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because most of the activity I've done has been in the last 24 hours.
So, it has a list of active campaigns currently just have one.
And we'll get to this in a little more detail in just a moment by clicking here
on campaigns,
but let's scroll down first.
So, we have a network in security summary, nice beautiful graphical
representation,
detected threats.
And if we scroll down, we have a global map, so I downloaded a little
something malicious a little while ago.
And when I downloaded, I downloaded one of them from Germany and the other one
right here
from looks like Russia.
And that was an intentional, I just was doing a search and download some files
and test files,
and that happened to be where the servers were that I got them from. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that happened to be where the servers were that I got them from.
If we scroll down, it has details regarding new unique detections.
And if there was malware that had been seen, and if we had set up our system 2
capture,
either suspicious or known malware, we can see this in a list right here.
So, let's go back up to the top and let's go ahead and take a look at campaigns
.
Again, this is part of the NSX network detection and response.
So, here's my current ongoing campaign, I'll go ahead and click on it.
So, across the top, I have an overview that hosts in timeline history, evidence
,
and then here are the attack stages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then here are the attack stages.
So, there's the delivery, exploitation, command and control.
So, when this threat showed up, it was associated at this level of the attack
stage,
the command and control.
And then if we scroll down, there's a beautiful graphic.
And I'll go ahead and make this a little bit bigger.
So, this is a graphic just representing what happened.
So, there was the machine I was working from, there's the system I got it from,
and this could help us track where that virus is showing up in our topology.
So, if this machine was compromised, and then there was a pivot done,
and then the attacker or the software during the attacking started making its WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then the attacker or the software during the attacking started making its
way further
in the network, this could visually help us see where that compromise has taken
place.
So, if we go back up to the top, we can click on host right here.
So, there was the host involved, and then there's a tab here for history.
And a tab for evidence.
So, if we expand this, it gives us more details on that compromise or that
attempted compromise.
And so, here on the left, we're going to have a lot more of the same
information,
just sorted a little bit differently.
So, if we click here on host, here we can click on host with threats to just
see those,
or open high impact threats, see just those. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or open high impact threats, see just those.
And one of the cool things about this is that there's so many hyperlinks
involved.
For example, this host right here, 1055 0151.
If you wanted to know more about that, we can just click on that individual
host.
So, here's the overview, we can go to the threats we're in that host, and
events regarding that
host.
So, there's the Germany and Russian flags representing the source of where I
downloaded those from.
And if we go back to overview, there's also a link right here regarding the VM,
where we could view that VM in the inventory insight NSX manager.
So, it's taking us back over to NSX manager. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, it's taking us back over to NSX manager.
Effectively, it's just another tab.
And this is just a little reminder regarding the app switcher,
this little widget up here on the top right that we can use to go between the
NSX advanced load balancer,
the network detection and response, and also cloud services manager.
Should we be using any of those services?
So, I'll say got it.
And then here is that virtual machine that had the attacks.
So, if we want to go back to the network detection and response,
we could go ahead and go to the previous tab, or we could just click up here,
and it'll open up a new tab for us.
So, on the left, if we go down to events, here are the events. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, on the left, if we go down to events, here are the events.
We have another option here for instance, and then a section for file download,
and also down here for alert management.
And in the event that we did capture some files based on our configuration,
there's an option right here for a nice centralized location for files
downloaded,
where we can look and sort through those.
So, again, the network detection and response is a fantastic option.
As part of the NSX application platform, to have kind of a one-stop shop for
visualization
and correlation of our network events.