NetWitness Minidecoder in Action

Many TaoSecurity Blog readers are undoubtedly familiar with NetWitness. Several weeks ago I met with their CEO and CTO to discuss their products and services. They were kind enough to later provide me with a device that they ship to their engineers to provide testing and experimentation with their product. Here I call it a "Minidecoder," but you can think of it as "NetWitness in an EeeBox PC" (specifically the EeeBox PC EB1012).

As you can see in the diagram, it only has one onboard NIC, and that is used for management. To access traffic, NetWitness provided a Trendnet TU2-ET100 USB to 10/100Mbps Adapter. To try the Minidecoder, I paired it with the DualComm device mentioned in my last post. I basically tapped the Minidecoder's own management port and then generated some basic traffic from the Minidecoder's Linux shell. The sensor also saw its own management traffic, as well as broadcast traffic passed by the wireless bridge to which it was connected.

Setup was pretty painless. I booted the Minidecoder, logged into the Linux OS, connected the network cables, and configured the management port.

To administer the device and access the data, I installed the NetWitness Administrator and Investigator applications on a Windows XP SP3 laptop.

In the screen capture at left, you see part of the Administrator interface. It was easy to add and connect the Minidecoder after I obtained a license from NetWitness. I didn't need to run anything on Windows with Administrator privileges, other than the installation process.

I'm not a big fan of dashboards, but I wouldn't expect to spend much time in this view anyway. The action is in Investigator, which I also installed.

As you can see in the figure at right, NetWitness breaks down the traffic using a variety of means. I'm only showing what would fit on the screen.

One of my favorite aspects of the NetWitness metadata approach is the way it extracts meaningful content automatically, like the system names from within DHCP traffic (independent of DNS names, for example). This is why I've added metadata as the seventh form of NSM data (after full content, session, statistical, alert, transaction, and extracted content). NetWitness is good at depicting "data about data," i.e., details about traffic, derived from the traffic.

I also like the way NetWitness classifies a variety of traffic into "Action Events" like "Get". Here I will select the sessions associated with the Get Action Event to produce the screen shot that follows.

In this screen capture you can see sessions which NetWitness classified as Get events. I chose part of a Lynx session where I browsed to www.bejtlich.net. The large sessions with the "Click to Create" boxes are sessions where I retrieved packages for installing Lynx on the Linux OS of the Minidecoder itself. (Remember this traffic is to and from the Minidecoder, just for the sake of the test.)

I think this is a cool way to get more familiar with NetWitness in a low-impact way. I wouldn't try to stress test this device since neither the hardware nor the NICs are intended for intense use. Rather, you could deploy a device like this in your environment to get a better idea of how NetWitness would process your environment's traffic, or at least a subset of it, if you had to throttle what was sent to the sensor.

Feel free to contact NetWitness for more information, and thanks to Amit and Tim for the demo gear!

Comments

Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more