Overview

Lumeta ESI includes a multi‐phase indexing methodology that identifies all assets on a network and provides a topological map of the network. It offers comprehensive, real-time network visibility to hunt for new or changed infrastructure, routes, paths, and devices, which is essential for breach detection in virtual, cloud, mobile and software-defined networks. Lumeta ESI delivers:

Network Infrastructure Analytics: Providing organizations with a true view of what the network really looks like (what devices and connections are attached, and how) in real time. To understand the entire network at any time, organizations need:
• an authoritative network census
• real-time network infrastructure updates (broadcast, OSPF, BGP, etc.)
• address space validation
• network edge definition
• unreachable network segment identification
• device indexing/profiling, both passive and active
• enterprise-wide certificate identification
• network topology mapping
• port mapping/usage
Network Segmentation Analytics: Providing the advanced intelligence organizations now require to verify their network segmentation and fully understand their network architecture relative to the organization’s policy. Having tools which enable quickly detecting leak paths, unauthorized Internet connectivity, multi-homed hosts, split tunneling identification, unauthorized bridging device identification along with hybrid physical/virtual segmentation provides the information teams need to understand, detect and prevent breaches.
Breach Detection Analytics: Via seamless integration of Lumeta’s comprehensive network indexing to external threat intelligence sources (with the ability to ingest open source threat intelligence feeds), it operationalizes in-depth intelligence enabling security teams to:
• Identify any internal use/accessibility of known Trojan/malware ports;
• Correlate NetFlow data to malware command and control (C2) servers;
• Hunt for zombies on the network.

Lumeta’s foundational intelligence is also integrated (via an open API) with third-party products such as SIEM, GRC, HVA, IPAM, and Endpoint Detection & Response greatly improving analytical capabilities, allowing organizations to fully understand their IT environment in more context and have greater insight into network traffic, connections and devices.