TRITON RiskVision Diagnostics

52060 | Diagnostics | TRITON RiskVision | 24-Sep-2015

Use the Diagnostics page in the RiskVision Local Manager to:

Get a quick overview of monitored protocols by bandwidth and number of packets (see RiskVision protocol overview).

Find detailed statistics about monitored sessions, and a tool to log all session data for diagnostic purposes (see Reviewing RiskVision session details).

Find detailed statistics about monitored, whitelisted, and ignored packets (see Reviewing RiskVision packet statistics).

Get performance information for key RiskVision components, including plugins (see Investigating RiskVision performance).

The Diagnostics pages provide information primarily for 3 services:

Capture monitors a network interface and records IP traffic as pcap files.

IP packet statistics reflect the performance and health of the Capture service.

Assembler reads the pcap files provided by Capture and:

Identifies HTTP and SMTP transactions

Removes duplicate packets

Properly orders packets

Writes HTTP and SMTP request and response data to disk for further processing

Session statistics reflect the performance and health of the Assembler service.

Transaction Processor takes the request and response files provided by Assembler and provides them to each of the Local Analysis plugins on the appliance.

If any plugin identifies a transaction as malicious, suspicious, or violating a data loss or data theft policy, or if a plugin flags the transaction for further processing by Cloud Analytics, an incident is sent to Data Server for logging.

Transaction Processor and plugin statistics provide insight into the performance and health of Local Analysis.