Getting Started with LANGuardian Aisling Brennan 14th November 2013

Agenda Live tour of LANGuardian Review of deployment options Review of common administrative tasks Working with NetFort Technical Support Q&A session

Live tour of LANGuardian Two live demo systems are available: Standalone LANGuardian system LANGuardian integrated with SolarWinds Network Performance Monitor http://www.netfort.com/downloads/live-demo You can go onto our website - where there is a version of our system available, that's got some data in it At the heart of LANGuardian is a DPI engine. You can use it for internal network and user activity. List of things you can do is endless, activity including security (bittorrent), bandwidth, file activity, internet and forensics. There are no agents or clients, and no negative impact on the network. The primary source of data is from a span or mirror port. Let me give you a quick run through the key features. once you install it, no of ways you can access the info use our web front end, can also get alerts, someone tries to scan your network, virus, can also get reports, come in the morning, top users, top applications, top sec events also use other tools to access our db, other nm tool, like excel api gain access to date today web front end most people use when you log on 4 options home page bw troubleshooting want to see what traffic is like between 2 sites what is happening on a server, what type of connections 192.168.0.0/16 cedar notation change time, it defaults last hour we do not age data, the level of details you get right now, go back a week ago and get same level of at most customers keep a couple of months live data user monitoring Let’s say your manager wants to know what a user did on the network. Type in the username on the forensics tab and press go. So what do we know about this user: Total amt of traffic, applications being used, events user is triggering internally within the network, we're inside the network, spam from a system, it’s running bittorrent, bypass attempt feature in lg, we provide an audit trail of what people are doing on file share (cifs, nas device, nfs) type in a file, who deleted a file off the network Also view report with usernames overlap with what you got we also do web activity monitoring, lets see who’s been accessing youtube. who's on a website/view with username not only website, drilldown see the video name stores uri, page / lot of bw consumption on internet gateways, lg great too to be able to drill down what users are consuming most amount of data, what websites, reporting included in lg. extensive reporting - too many reports maybe! mac addresses, ethernet reports, security report. IDS included in lg based around snort ids engine. Snort uses sigs to detect certain activity on your network. we also have dashboards, customizable, add /change elements, set up these, mobile devices, also have ad module lg can gather user logon from the ad infrastructure, not only see ip addresses also usernames 3

Review of deployment options Install it on a dedicated physical PC or server Install it as a Vmware virtual appliance http://www.netfort.com/software-download 4

Common administrative tasks Identity configuration Sensors Database Custom reports Email distribution lists Dashboards 5

Working with NetFort Technical Support Get instant online support Use the customer checklist Documentation Follow up on Twitter @NetFort Watch videos on YouTube at NetfortTechnologies 6

7