The SC//AcuVigil™ Network Traffic Analysis application, listed in the App Catalog as Traffic Analysis and known in earlier documentation as Firewall Logger, logs information about every connection made across segments or out through the WAN or backup interfaces. It doesn't log traffic that stays within a segment or that goes across VPN tunnels.
Where to find it
- For all your sites: from the Apps menu, select Traffic Analysis. The Network Traffic Analysis page holds the company-wide default settings. The page says these values "will appear as the default values when initially configuring the app at a specific location."
- For one site: on the site's Network tab, the Network Traffic Analysis block shows Logging Mode (for example,
FCL), Logs Sent, Logs Failed, Daily Limit, User Dashboard Access, and a Last 24 Hours link, with an Update Configuration link in its header.
Company-wide settings
| Setting | Description |
|---|---|
| Enabled | Whether logging is turned on by default when the application is set up at a site. |
| Private Log Collections | A checkbox, labeled Enabled. |
| Daily Limit | The number of connections to log each day. Use 0 for unlimited. |
| Mode | FCL or IDS. |
| Segment | A network segment, chosen from the company's segment list. |
| Threat feeds | ciarmy, et_ips, mandiant, and tor. |
| Log Sync | Where logs are sent: Sematext or Elastic. |
| Elastic Username, Elastic Password, Elastic Sink, Elastic Index, Kibana Dashboard URL | Connection details for the Elastic log destination. |
Scale Computing manages these company-wide settings as part of the managed service. To request a change, contact Scale Computing Support.
Levels of service
| Level | What you get |
|---|---|
| Basic | Logs 50,000 connections each day, starting at midnight local time, and keeps the past seven days of records for analysis. Includes near real-time alerts for anonymous proxy connections. |
| ESS | Raises the connection logging limit and adds Managed Detection and Response (MDR) services. |
| ESS Plus | Adds intrusion detection (IDS) with threat feeds. |
| ESS PCI | Adds intrusion detection (IDS) with threat feeds, for PCI DSS environments. |
Viewing connection logs
Connection logs are sent to Sematext or Elastic, depending on the Log Sync setting, and can be viewed in Kibana dashboards. On a site's Network tab, the Network Traffic Analysis block has a Last 24 Hours link and shows whether User Dashboard Access is enabled.
Tips for searching logs
- New traffic is marked with the log type
LNwhen it enters the firewall. Blocked traffic is also markedLBwhen it leaves the firewall without matching an allow rule. - Every blocked connection has two log entries, one
LNand oneLB. Because of this, filtering outLBentries doesn't show you only allowed traffic. - In Kibana searches, the period (
.) and asterisk (*) are both wildcards, but you can use only one wildcard in each search term. For example,id_orig_n:back*PC.returns an error, butid_orig_n:backofficePC.andid_orig_n:back*PC1return results.
Setting up Network Traffic Analysis
Scale Computing sets up Network Traffic Analysis for you as part of the managed service, matched to your level of Enhanced Security Service (ESS):
- The Traffic Analysis application and the ESS application for your level of service (ESS Standard, ESS Plus, or ESS PCI) are installed at the site.
- Logging is enabled in the Network Traffic Analysis block on the site's Network tab, with the daily connection limit for your level of service.
- ESS Standard uses the ciarmy threat feed. ESS Plus and ESS PCI use IDS mode with every threat feed (ciarmy, et_ips, mandiant, and tor).
To request Network Traffic Analysis or change its settings, contact Scale Computing Support. Open a ticket in the SC//AcuVigil dashboard, email team@scalecomputing.com, or call (512) 687-7401.
System requirements
- Scale Computing ESD: MG3, SG1v1, SG2v1, XG1v1, or VG