{"id":3588,"date":"2024-05-15T16:11:09","date_gmt":"2024-05-15T21:11:09","guid":{"rendered":"https:\/\/bluecatnetworks.com\/?p=276764"},"modified":"2024-05-15T16:11:09","modified_gmt":"2024-05-15T21:11:09","slug":"detect-anomalies-and-cve-risks-with-infrastructure-assurance-8-4","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/05\/15\/detect-anomalies-and-cve-risks-with-infrastructure-assurance-8-4\/","title":{"rendered":"Detect anomalies and CVE risks with Infrastructure Assurance 8.4\u00a0"},"content":{"rendered":"

For IT operations teams needing deeper and more automated insight into anomalies and vulnerabilities in their security and network infrastructure, BlueCat Infrastructure Assurance 8.4 is now available.<\/p>\n

Infrastructure Assurance<\/a> avoids network disruption with automation. It is a proactive observability, troubleshooting, and remediation solution for network and security infrastructure like DDI, firewalls, and load balancers. It continuously scans infrastructure for issues and serves up recommended remediation steps that IT operations teams can use to address issues before they cause harm and avoid costly outages.<\/p>\n

In this post, we\u2019ll highlight new features in the Infrastructure Assurance 8.4 release, including an anomaly detection engine that uses machine learning models to identify outliers for several metrics in your Palo Alto Networks and BlueCat Integrity devices. Further, we\u2019ll delve into the new CVE analysis engine that uncovers device vulnerabilities for certain CVEs. And finally, we\u2019ll briefly highlight other reporting, alerting, and knowledge enhancements.<\/p>\n

\"Diagram<\/p>\n

Anomaly detection engine<\/h2>\n

The anomaly detection engine uses machine learning models to identify outliers and unusual behaviors for several metrics in your Palo Alto Networks Next-Generation Firewalls and BlueCat Integrity<\/a> DNS and DHCP Server (BDDS) devices. An anomaly detection generates a warning alert.<\/p>\n

With awareness of such anomalies, Infrastructure Assurance can identify early symptoms and emerging issues, allowing you to address them before they become bigger problems. Our implementation uses the standard score or z-score<\/a> method to detect anomalies. A z-score measures exactly how many standard deviations above or below the mean a data point is.<\/p>\n

The system evaluates several metrics based on a week\u2019s worth of data points. The newly embedded time-series database stores these data points. When a new data point is collected, a z-score is calculated. An alert is generated if the z-score of that data point is greater than 3 (or less than -3). The alert will remain active for 10 minutes. During that time, if no other anomalies are detected, the alert will resolve itself and go into the cooldown state. If another data point has a z-score greater than 3 (or less than -3), the alert will remain active for another 10 minutes.<\/p>\n

Next, we\u2019ll look at what metrics we\u2019re applying to the method to detect outliers and why they\u2019re important.<\/p>\n

Anomalies for Palo Alto Networks Next-Generation Firewalls<\/h3>\n

Palo Alto Networks Next-Generation Firewalls keep a count of all drops and what causes them. Analyzing these drop counters provides insights into the processes, packet flows, and sessions on the firewall. Infrastructure Assurance 8.4 now analyzes four global drop counters for anomaly detection.<\/p>\n