How is Threat Manager data collection accomplished?

Answered

Permanently deleted user

• May 10, 2016 19:42

How is Threat Manager data collection accomplished?

Yes 0 No

• Official comment

  

  Lindsey Stirneman

  • June 01, 2016 18:21

  Threat Manager requires the Alert Logic Appliance (physical or virtual) in every deployment in which we engage. The Alert Logic Agent is required in public and private cloud environments on any host that should be protected. The Agent may be used optionally in traditional environments if desired.

  Agent-based Deployments

  Appliances will receive traffic from the Alert Logic Agent, which when installed on a protected host, will capture the traffic that hits the host's network interface and forwards that traffic to the appliance.

  Appliance Only Deployments

  When not using the agent, appliances may receive traffic from network SPANs (port mirroring) or network taps. With network SPAN, customers will need to configure their network switches to forward a copy of the traffic they wish to monitor to a monitoring port on the Alert Logic appliance.

  Network taps are less common but are used in some deployments. Taps are reliable tools to get data off of the network to a monitoring appliance and would be used if a customer is resistant to tasking their switch fabric with mirroring traffic. Alert Logic will recommend a network tap vendor for customers to contact when they wish to use this option.

Please sign in to leave a comment.