Port Mirroring for Advanced Threat Analytics
The main data source used by ATA is deep packet inspection of the network traffic to and from your domain controllers. For ATA to see the network traffic, port mirroring needs to be configured. Port mirroring copies the traffic on one port, known as the source port, to another port, known as the destination port. ATA works with most solutions that can mirror traffic - if the traffic can be port mirrored to ATA, it can be used to analyze threats to your system https://technet.microsoft.com/en-us/library/mt429376.aspx.
One of the most common questions for Advanced Threat Analytics is on how to mirror ports.
I will give some references to different sites that will provide information on how to create mirrored ports.
Switches that support mirroring https://www.miarec.com/knowledge/switches-port-mirroring
Hyper-V
Vmware
HP
https://h10032.www1.hp.com/ctg/Manual/c02640590
Cisco
Juniper
NetGear
https://www.miarec.com/knowledge/how-configure-port-mirroring-netgear-fs726t
TP-Link
https://www.miarec.com/knowledge/how-configure-port-mirroring-tp-link-tl-sl2428web
Dell
https://www.miarec.com/knowledge/how-configure-port-mirroring-dell-powerconnect-2700-series
D-Link
https://www.miarec.com/knowledge/how-configure-port-mirroring-d-link-des-3010
Most of these links points for other vendors webpages and they are the ones that can give support on their products.
To verify that the port-mirroring is working (https://technet.microsoft.com/en-us/library/dn707710.aspx), remember to use Network monitor on the ATA Gateway.
https://technet.microsoft.com/en-us/library/mt163705.aspx
Comments
- Anonymous
July 11, 2016
EXCELLENT reference material, thanks!