Loading

×Sorry to interrupt
This page has an error. You might just need to refresh it.
[NoErrorObjectAvailable] Uncaught ReferenceError: addCTracking is not defined
Failing descriptor: {markup://c:KM_ArticleThemeLayout}

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Addressing Secrecy Concerns for On-premise Communications with NSX Network Detection and Response Cloud (900185)

Last Updated: 12/3/2019Categories: InformationalTotal Views: 841Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

The Issue:

Some customers are extremely concerned about the security of the data under analysis and, therefore, believe the best policy is to keep all information inside the local network. In this case, "data under analysis" includes files within the network hosts that become infected and files or information that came from the Malscape. Although we at VMWare guard the privacy of all customer information and present in this article the security reasons for the outbound communications at issue, we also provide the means for customers to disable the outbound communication.

This customer concern applies to communication with the NSX Network Detection and Response cloud and the important purpose of Lastline's ability to communicate with a C&C server. This article describes the benefits of allowing these outbound communications and also describes how to use the lastline_setup utility to disable certain outbound communications. The first section describes the benefits of allowing these outbound connections. The second section describes how to use the lastline_setup utility to disallow specific details of outbound communication to the NSX Network Detection and Response cloud.

Reasons for Allowing Outbound Communication

On-premises NSX Network Detection and Response can perform its analysis without communicating anything back to the cloud, but this limitation undermines NSX Network Detection and Response's unparalleled accuracy in determining what the malware is trying to do. This assertion is based on two realities of network security:

Thorough analysis includes observation of the malware doing the bad things it was designed to do. VMWare observes the behavior so that it can track the malware back to its C&C roots. (Keep in mind that the NSX Network Detection and Response sandboxes remain isolated from the network so that no analysis happens inside a customer network, and, therefore, no data inside the network is at risk.) No vendor can honestly claim that an on-premise product can do thorough analysis without letting the malware run fully (which includes the malware's outbound communication attempts).

Malware can do many unexpected and unusual things in different environments. Our cloud-based analysis is best suited for checking for these variations. One part of our product that enables much greater accuracy in these cases is our extensive database of known threats. We can perform an analysis that is more advanced than what is possible on the customer premises.

How to Turn Off Transmission of Information to NSX Network Detection and Response Cloud

The lastline_setup utility has the commands for disabling different communications between the on-premise NSX Network Detection and Response and the NSX Network Detection and Response cloud. (Refer as needed to the installation manual and its screenshots.) The types of change to outbound communication that the utility supports are as follows:

No files are shared with the NSX Network Detection and Response cloud.

The metadata for files are not shared with the NSX Network Detection and Response cloud.

The origin of the artifacts’ download does not go to NSX Network Detection and Response cloud.

The origin of the malicious artifacts’ download does not go to NSX Network Detection and Response cloud.

The metadata for malicious files do not go to NSX Network Detection and Response cloud.

After logging into the CLI, starting the lastline_setup utility, and entering your user password at the sudo prompt, the available arguments for which the choice is to turn off a particular communication are as follows:

To disallow all artifact hash sharing with the NSX Network Detection and Response cloud:

cloud_analysis off

To disallow sharing artifact metadata (IP and host of the server from where the file is downloaded from) with the NSX Network Detection and Response cloud:

cloud_analysis_push_download_metadata off

To disallow sharing the source of downloaded artifacts (information about protocol details of the file download, including server path, HTTP referrer, HTTP user-agent, and the raw HTTP request) with the NSX Network Detection and Response cloud:

cloud_analysis_push_download_source off

To disallow sending of file metadata (download origin, filename, type) for malicious files:

cloud_analysis_push_malicious_download_metadata off

To disallow sharing of the origin of malicious downloads (see download_source above) with the NSX Network Detection and Response cloud:

cloud_analysis_push_malicious_download_source off

To disallow sharing of the Android APK files with the NSX Network Detection and Response cloud:

cloud_analysis_push_apk off

To disallow sharing of the Mac OS artifacts(Mach-O binaries, DMG, PKG) with the NSX Network Detection and Response cloud:

cloud_analysis_push_macho off

For more information please refer to the latest Manager installation guide.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
修改在 vSAN 数据存储中的快照上运行的虚拟机上的存储策略规则 (70797)

KB
•
Windows 10 Wi-Fi プロファイルがインストールされない (85058)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware NSX Detonator

VMware NSX Defender

Related Versions:

Take Our Survey

Support Assistant