FireMon Asset Manager
Page tree

Versions Compared

Old Version 4

changes.mady.by.user user-05670

Saved on

compared with

New Version Current

changes.mady.by.user author

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Verisign iDefense is a closed-source threat intelligence feed available to all Lumeta Asset Manager customers. This feed correlates iDefense IPs against your network's IPs to produce actionable lists of zombie devices and threat flows in your network.

To use iDefense, you'll need the to obtain an iDefense license key provided by Lumeta. Look for this key in the original welcome email message you received from Lumeta Support. If you can't find your iDefense key, please contact us. (not provided by FireMon).

Excerpt

To produce threat flow results, you'll need a single source of NetFlow data such as Gigamon NetFlow. Lumeta Asset Manager can receive NetFlow from a single source. If you have multiples, consider using a NetFlow aggregator. You will also need to direct the NetFlow results to your Lumeta Asset Manager Command Center. These topics are out-of-scope for Lumeta Asset Manager documentation, but your Solutions Architect and Support can nevertheless help with implementation. 

To You do not need NetFlow data to show the zombie devices in your network, you do not need NetFlow data. This dashboard is generated using native LumetaAsset Manager-indexed data.

The iDefense feed is correlated against NetFlow data.  The intersection of the two populates the threat_feed_ip table. Browse to Navigate to Settings > Tables > threat_feed_ip > View to open the table. 

...

To configure the feed . . . 

  1. Enable the capture of NetFlow data.
  2. Configure and enable iDefense in LumetaAsset Manager.


Excerpt

Anchor
e
e
Enable NetFlow

The NetFlow-capture service enables your Lumeta Asset Manager Command Center to ingest NetFlow data.

To enable NetFlow capture from the Lumeta Asset Manager GUI:

  1. On the Lumeta main menu, browse to Asset Manager toolbar, navigate to Settings > Support Tools > Status of Lumeta Asset Manager Components.
  2. Start the Netflow Packet Capture Service and click Run. 


    The status of the service will change to Running.

To enable NetFlow capture from the Lumeta Asset Manager command-line interface:

  1.  Log in to the CLI.
  2. At the command-line prompt, enter support service packetcapture start.
  3. Exit the CLI.

Configure the iDefense feed as follows:

  1. On Lumeta's main menu, browse to the Asset Manager toolbar, navigate to Settings > Integrations  > Subscription Feeds > > iDefense.  
    Image RemovedImage Added

  2.  Enable Enable the threat feed by moving Active slider to the right. 
    The label changes from a red No to a green Yesswitching the toggle to active.
  3. Input a Polling Interval to indicate the time that should elapse between fetching the latest feed data. Input 24 to poll daily, input 12 to poll twice a day, and so on.
  4. Input an license key from iDefense.
  5. Click Submit.  
    Feed is configured.

 

 

...