|
|
| (37 intermediate revisions by the same user not shown) |
| Line 1: |
Line 1: |
| [[Tech Notes]] > Security Services Platform | | [[Computer Notes]] > Security Services Platform |
|
| |
|
| = Overview =
| | [[Computer Notes/Security Services Platform/Accessing the K8 Cluster|Accessing the K8 Cluster]] |
|
| |
|
| * Runs Vdefend security services
| | [[Computer Notes/Security Services Platform/EULA bypass]] |
|
| |
|
| * This is an integrated security platform that can be deployed in the cloud.
| | [[Computer Notes/Security Services Platform/SSP Intro]] |
| | |
| * Services run inside kubanties on virtual machines
| |
| | |
| | |
| | |
| == Services include ==
| |
| | |
| | |
| * Security Intelligence
| |
| | |
| * Network Detection and Response
| |
| | |
| * Malware prevention
| |
| | |
| * Rule Analysis
| |
| | |
| | |
| = Install process =
| |
| | |
| | |
| * Install SSP on vSphere
| |
| | |
| :* Install NSX
| |
| | |
| ::* Link SSP to NSX
| |
| | |
| ::* Install platform features
| |
| | |
| | |
| vSphere > SSPI > NSX > NSX Features
| |
| | |
| | |
| = Components =
| |
| | |
| == vSphere ==
| |
| | |
| * vSphere controls the clusters.
| |
| | |
| :* By default a cluster has 3 hosts
| |
| | |
| :* This default is often expanded
| |
| | |
| | |
| * Virtual machines are started on the hosts
| |
| | |
| :* SSPI and NSX run on their own VM's
| |
| | |
| :* Other VM's include:
| |
| | |
| ::* Ssp-service-controller
| |
| ::* SSP-servie-md-0-worker '''two of these'''
| |
| | |
| | |
| This configuration gives a total of 5 VM's and 3 Guest OS in a basic configuration.
| |
| | |
| | |
| == NSX ==
| |
| | |
| * Management is performed in NSX.
| |
| | |
| :* After deployment of the NSX connect to the web UI using IP / FQDN
| |
| | |
| | |
| Features are based off the configuration you set in NSX:
| |
| | |
| | |
| '''Security Intelligence'''
| |
| | |
| This feature provides distributed visibility and policy recommendations within an NSX environment, and lets you visualize security posture, analyze traffic flows, and create micro-segmentation policies.
| |
| | |
| | |
| | |
| | |
| ''Network Detection and Response (NDR)''
| |
| | |
| This feature continuously monitors your network for threats and anomalous behavior, using techniques like network traffic analysis, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), and advanced threat analysis, and then responds to identified threats.
| |
| | |
| | |
| | |
| | |
| ''Malware Prevention Service (MPS)''
| |
| | |
| This feature provides file-level protection against known and unknown malicious files, including zero-day threats, by analyzing traffic and extracting files for analysis.
| |
| | |
| | |
| | |
| | |
| ''Network Traffic Analysis (NTA)''
| |
| | |
| This feature monitors and inspects network traffic patterns and identifies anomalies or suspicious behavior.
| |
| | |
| | |
| | |
| | |
| ''Metrics''
| |
| | |
| This feature collects point-in-time, time-series, and lifetime data to let you perform analyses (such as Top N) of your environment.
| |
| | |
| | |
| | |
| | |
| [https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/vdefend/security-services-platform/5-0/security-services-platform-overview/key-concepts.html]
| |
| | |
| = Reference Material =
| |
| | |
| [https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/vdefend/security-services-platform/5-0/reference-material.html techdocs]
| |
