Forensic and Audit Products

Network Forensics tools sometimes referred to as NFAT's and Audit tools which can be referred to as device discovery, mapping or system documentation software augment traditional intrusion detection (IDS) and firewall products. IDS rules can detect many conditions reliably, however no rule set can possibly detect all possible intrusions.

Firewalls allow or disallow traffic to or from specific networks, machine addresses, and port numbers, but there are protocols that circumvent port-based security.

Forensics requires a complete record of your network traffic (packet captures) with appropriate analysis and reconstructive tools.

Good device audit and documentation tools provide essential information to aid in analysis.

Need Help Call: (866) 204-6289 or (310) 410-9350

 

Click on link below to submit electronic request:

 

Observer nVision

GigaStor Gigabit Capture Cards

Gigabit Capture Technology Security Forensics PDF

Network

With GigaStor everything is captured - every transaction, every packet, every protocol. And it's captured for hours, days, and weeks. With this data and a unique time-based navigation system, your networking team has the benefit of perfect hindsight to attack every network problem and anomaly. Now it is easy to "rewind" your network, determine the source, perform comprehensive analysis, and move on.

GigaStor plays a significant role in data mining, network forensics, and data retention compliance. For example, the GigaStor not only shows communications that occurred, but it can reconstruct the mined data-providing hard evidence such as phone conversations, web pages, documents, instant messages, and e-mails.

Use GigaStor's retrospective network analysis to solve security problems. GigaStor acts like a security camera recording every action occurring on the network. If a breach is suspected, the GigaStor compares the breach to thousands of network attacks and anomalies with "Snort-style" IDS functionality. Once identified, the GigaStor provides drill-down analysis to determine the source and time of the occurrence.

Devices

nVision has a very advanced network scanner which allows you to discover all the hosts in your network. It also detects all routers and "goes through" them to scan all neighbor networks. In addition nVision can provide software and hardware inventory reports that include application programs, OS version, CPU, RAM, disk volume capacity, available free space, and more. The software inventory reports allow you to measure concurrent license use, and plan for software license requirements and upgrades. Hardware inventory reports provide a basic inventory of workstations and their configuration. Reports for SNMP switches and hubs provide port utilization and node information.

Optional nVision agents can monitor user activity on Windows computers:

• User login and activity/inactivity time
• Application usage grouped by the activity type (work, gaming, chatting, web browsing, etc.)
• Visited web pages
• User bandwidth usage in the user activity