The ____ consists of multiple servers configured as a Collector to store data and Sensors to supply data to the Collector.
DIP
Operators at the Mission Partner site could directly access the DIP while conducting mission operations on-site.
On-Site DIP
The DIP collector resides on the remote site with the Mission Partner.
Remote Operations
The DIP ______ main purpose is to capture MPNET traffic.
Sensor
This program saves raw pcaps to disks.
Arkime (Moloch)
This program analyzes network traffic against specific signature sets.
Suricata
This program can be a signature-based NIDS as well, but gains its power through the use of its scripting language.
Bro (Zeek)
A _____ _______ takes everything it sees on a port or ports you specify, then mirrors it out of another port.
Mirrored Port
- No disconnection needed for implementation
- Requires no hardware
- Can capture all traffic from a switch w/many links
Mirrored Port Pros
- Requires an open port on MPNET switch
- Requires MPNET support and configuration changes to equipment
- May drop packets on a saturated link
Mirrored Port Cons
A _____ is typically a dedicated hardware device providing access data flowing across a network and, ideally, will not affect the speed of the data traversing it.
TAP
- Virtually undetectable
- Does not require Mission Partner Device configuration to install
- Does not require processing power of device to mirror traffic
TAP Pros
- Disconnects the network when hardware is installed
- Only captures traffic sent through one link
- Requires purchase of equipment
TAP Cons
Is a passive, open-source network traffic analyzer.
Bro (Zeek)
A real-time Network Intrusion Detection System (NIDS).
Suricata
What are Suricata’s three operating modes?
- Sniffer mode
- Packet logger mode
- Intrusion Detection Mode
Automatically deletes oldest data to make room for new pcap when 95% of disk space capacity is reached.
Rolling packet capture
The sensor uses ________ to ship Bro logs and Suricata alerts to the Collector.
FileBeat
The ____________ is a server that provides a virtual, boundary protected, environment in which to deploy capabilities.
Collector
________ is an open source, server-side data processing pipeline ingesting data from a multitude of sources simultaneously, transforming it and then sending it to ElasticSearch. (Parses and normalizes data for ES)
Logstash
___________ _________ - Provides indexing for logs (Bro and Suricata)
Elastic Search
Lets you visualize your ElasticSearch data and navigate the ELK stack.
Kibana
________ aggregates data from the host, providing significant visibility into the behavior of a host. (installed at kernel level)
Endgame
Will serve as a DNS server for the DIP, allowing operators to query hostnames instead of IP addresses.
pfSense
