Network Traffic Analyzer (NTA)

• 1: Requirements
• 2: Deployment
• 3: NTA Details

1 - Requirements

What you need to get started

• Access to the SamurAI Portal and your specific tenant.
• A supported deployment platform for the NTA. Supported hypervisors and cloud platforms are listed below.
• An NTA virtual machine that meets the recommended specifications for the required monitoring throughput.
• Network changes required to meet the NTA communication requirements.
• A static IP address for the NTA management interface and DNS server IP addresses, unless you use DHCP.
• Access to configure traffic mirroring to the NTA monitoring interface.

Supported hypervisors

Supported cloud platforms

Amazon Web Services support

For AWS deployment, the NTA requires AWS Nitro instances that support traffic mirroring. For more information, refer to:

• Instances built on the AWS Nitro System
• Traffic mirror sources

Recommended specifications

NTA sizing is based on the expected monitored network throughput. Select the NTA size that meets your required throughput.

Communication requirements

The NTA requires connectivity to the resources listed below. Update security controls, such as firewall rules, proxy settings, and DNS configuration, as needed to allow the required communications.

What’s next?

You now understand the supported deployment platforms, NTA sizing requirements, and required communications. Proceed to SamurAI NTA Deployment.

2 - Deployment

Deployment considerations

Traffic source

The NTA is a passive device. It relies on customer infrastructure to send a copy of network traffic to the NTA monitoring interface. When deploying an NTA in a virtual environment or on Amazon EC2, consider the following requirements to achieve effective traffic monitoring and minimise performance impact.

Resource allocation

Ensure the NTA meets the recommended specifications. In some circumstances, the allocated resources may not be sufficient. We may recommend changes after the NTA is deployed and traffic throughput has been assessed.

Multi-NTA deployments

If expected network throughput exceeds the capacity of one NTA, deploy multiple NTAs to maintain coverage.

Network topology and segmentation

Map the virtual network topology and identify the optimal deployment location for the NTA. Consider both:

• East-west traffic between workloads on the same virtual switch, virtual network, or Amazon VPC.
• North-south traffic between internal and external networks, such as internet-facing web traffic.

Traffic visibility

A copy of monitored traffic must be sent to the NTA monitoring interface.

Recommended traffic sources include:

• Client-to-internet traffic.
• Client-to-client traffic.
• Client-to-server traffic.

Traffic that is typically not useful for NTA monitoring includes:

• High-volume encrypted traffic where the NTA cannot inspect the payload.
• SAN and backup traffic.

Capture traffic by configuring network mirroring or traffic monitoring for the selected deployment platform.

Virtual environments

Network mirroring on a virtual switch copies traffic from one or more source ports to a destination mirror port. Connect that destination to the NTA monitoring interface. In virtualised environments, the implementation may use port mirroring, SPAN, promiscuous mode, or a platform-specific monitoring capability.

Figure 1: The NTA in a virtual environment

Amazon EC2

For Amazon EC2 deployments, use VPC Traffic Mirroring to copy traffic from an Elastic Network Interface (ENI) to the NTA monitoring interface.

Figure 2: The NTA running on AWS

Create, configure and download an NTA

1. Log in to the SamurAI Portal, select Telemetry, and then select Network Traffic Analyzer from the main menu.
2. Select Create.
3. Complete the fields as required.

4. Select Create NTA after completing the relevant fields.
5. Select the NTA by clicking the NTA Name used in step 3.
6. Select Download.

The files you download depend on the selected deployment platform.

• Configuration

  • ISO — NTA-specific configuration file.
    • Required for all NTA deployments. Mount this ISO when the NTA starts for the first time so that it can configure and register with the SamurAI platform.

• Cloud init

  • AWS — Cloud-init data for an Amazon EC2 instance.

• Virtual machine

  • **OVA - Virtual appliance package for VMware vSphere and Proxmox VE (includes disk images)
  • VMDK — Virtual disk image for VMware vSphere manual deployment (not needed if using the OVA).
  • VHDX — Virtual hard-disk image for Microsoft Hyper-V.
  • **KVM bundle — — Virtual-machine package for KVM-based environments

7. Download the NTA configuration ISO file and the file or files required for the selected deployment platform.

NTA installation

Select the section relevant to your deployment platform:

• VMware vSphere
• Proxmox VE
• Microsoft Hyper-V
• KVM-based environments
• Amazon EC2

VMware vSphere installation

Follow the VMware documentation:

• Deploy a Virtual Machine from an OVF or OVA File in the VMware Host Client

1. Provide a meaningful virtual-machine name.
2. Select the NTA OVA file downloaded from the SamurAI Portal. Select the appropriate E1000 or E500 variant for the target environment.
3. Ensure the virtual machine is configured to use UEFI firmware.
4. Configure CPU, memory, storage, and both virtual network interfaces in accordance with the recommended specifications.

After deployment, mount the NTA configuration ISO file. Refer to VMware documentation:

• Configure a Datastore ISO File for the CD/DVD Drive

1. Select the NTA configuration ISO file downloaded from the SamurAI Portal.
2. Ensure the CD/DVD drive is connected when the virtual machine starts.
3. Confirm that Network Device (net0) is connected to the management network.
4. Confirm that Network Device (net1) is connected to the network or port group that receives mirrored traffic.
5. Start the virtual machine.
6. Continue to Deployment status.

Proxmox VE installation

Follow the Proxmox documentation:

• Import Wizard

1. Create or select storage to use as the import source.
2. Use the OVA/OVF import workflow to import the NTA OVA file downloaded from the SamurAI Portal. Select the appropriate E1000 or E500 variant for the target environment.
3. Ensure the imported virtual machine is configured to use UEFI firmware.
4. Configure CPU, memory, storage, and both virtual network interfaces in accordance with the recommended specifications.

Import the NTA configuration ISO file to Proxmox:

1. Navigate to Datacenter and select Storage.
2. Select the storage location where you want to store the ISO file.
3. Select ISO Images.

4. Select Upload.
5. Select the NTA configuration ISO file and upload it using the default settings.

Configure the NTA virtual machine to use the configuration ISO file:

1. Select the NTA virtual machine, select Hardware, and then select Add.

2. Select CD/DVD Drive.

3. Select Use CD/DVD disk image file (ISO), locate the NTA configuration ISO file, and select Add.

4. Confirm that Network Device (net0) is connected to the management network.
5. Confirm that Network Device (net1) is connected to the network or bridge that receives mirrored traffic.
6. Start the virtual machine.
7. Continue to Deployment status.

Microsoft Hyper-V installation

Follow Microsoft documentation:

• Create a virtual machine in Hyper-V

1. Provide a meaningful virtual-machine name.
2. Create the NTA as a Generation 2 virtual machine.
3. Configure CPU, memory, storage, and two virtual network adapters in accordance with the recommended specifications.
4. When prompted to connect a virtual hard disk, select the NTA VHDX file downloaded from the SamurAI Portal.
5. Attach the NTA configuration ISO file to the virtual DVD drive and ensure the drive is connected at startup.
6. Connect Eth0 to the management network.
7. Connect Eth1 to the virtual switch or network that receives mirrored traffic.
8. Start the virtual machine.
9. Continue to Deployment status.

KVM-based environments installation

This section applies to KVM environments, including platforms that use libvirt, QEMU/KVM, Open vSwitch, or another KVM management interface. The exact workflow for creating or importing a virtual machine and configuring traffic mirroring differs by KVM management platform. Follow your platform’s documentation for these actions.

Prerequisites:

1. Download the NTA configuration ISO file for the NTA you created.
2. Download the NTA KVM bundle.
3. Extract the KVM bundle.

Use your KVM platform documentation to create or import a virtual machine from the extracted NTA image.

When creating or configuring the NTA virtual machine:

1. Configure the virtual machine to use UEFI firmware.
2. Configure CPU, memory, system disk, and data disk in accordance with the recommended specifications.
3. Add two virtual network interfaces.
4. Connect the first interface to the management network, which must allow the required outbound connectivity.
5. Connect the second interface to a dedicated monitoring network, virtual switch, bridge, or port that receives mirrored traffic.
6. Attach the NTA configuration ISO file as a virtual CD/DVD drive.
7. Ensure the virtual CD/DVD drive is connected when the virtual machine starts for the first time.
8. Start the virtual machine.
9. Continue to Deployment status.

Refer to the documentation appropriate for your KVM environment:

• libvirt domain XML format
• Red Hat Enterprise Linux: Managing virtual devices
• Open vSwitch: Basic configuration and port mirroring

Amazon EC2 installation

Prerequisites:

1. Download the AWS cloud-init.yaml file from Create, configure and download an NTA. You will use this file during EC2 instance deployment.

Follow Amazon documentation to launch an EC2 instance:

• Launch an instance

Apply the following adjustments while following the Amazon documentation:

1. Select Ubuntu as the AMI.
2. Select the latest supported Ubuntu 24.04 Server AMI.
3. Select an instance type that meets the recommended specifications.
4. Configure the key pair and network settings according to your organisation’s policies. Ensure network settings fulfil the communication requirements.
5. Configure storage according to the system-disk and data-disk requirements for the selected NTA size.
6. In Advanced details, paste the contents of the AWS cloud-init.yaml file into User data. Do not select User data has already been base64 encoded.
7. Complete the remaining instance configuration according to your organisation’s requirements and the Amazon documentation.
8. Configure VPC Traffic Mirroring so that the selected traffic is sent to the NTA monitoring interface.
9. Continue to Deployment status.

Deployment status

After deploying the NTA, view deployment progress and status in the SamurAI Portal.

1. Log in to the SamurAI Portal.
2. Select Telemetry, and then select Network Traffic Analyzer from the main menu.
3. Select the relevant NTA.
4. Under General, the Status initially displays as Provisioning.
5. Review Deployment Status, which displays deployment phases and timestamps. Each completed phase is shown in green.

6. When NTA deployment is complete, Status initially displays as Not Healthy while individual components start. The status changes to Healthy when startup is complete, which can take approximately five minutes.

Configure traffic mirroring

After deployment, determine the NTA monitoring interface before configuring traffic mirroring.

1. Log in to the SamurAI Portal.
2. Select Telemetry, and then select Network Traffic Analyzer from the main menu.
3. Select the relevant NTA.
4. Select System Information and review Network to identify the Management and Monitoring interfaces. Record each MAC address and confirm that it matches the relevant hypervisor or AWS configuration.
5. Configure traffic mirroring to send the required traffic to the NTA monitoring interface. Refer to your deployment platform documentation because mirroring implementations differ between environments.

Useful vendor documentation includes:

VMware vSphere

• Working with port mirroring

Microsoft Hyper-V

The following Microsoft documentation uses Microsoft Defender for IoT examples, but its traffic-mirroring concepts also apply to NTA deployments:

• Traffic mirroring overview
• Configure traffic mirroring with a Hyper-V virtual switch

KVM-based environments

Use the traffic-mirroring capability of the KVM platform, virtual switch, bridge, or network fabric that carries the traffic you want to monitor. Examples include Open vSwitch port mirroring and platform-specific bridge or switch mirroring.

• Open vSwitch: Basic configuration and port mirroring

Amazon EC2

• What is Traffic Mirroring?

Detection testing

After deploying the NTA, validate that network traffic is monitored and analysed correctly.

The NTA includes a built-in test detection signature that triggers on ICMP Echo Request traffic with a payload size of 333 bytes. This allows you to validate end-to-end traffic visibility and detection without affecting normal operations.

Generate test traffic

Generate ICMP traffic using one of the methods below.

Windows

From Command Prompt, run:

ping -l 333 X.X.X.X

Linux

From a terminal, run:

ping -s 333 X.X.X.X

Cisco routers and switches

Use Extended Ping and specify a datagram size of 361 bytes.

The Extended Ping datagram size includes:

• IP header: 20 bytes.
• ICMP header: 8 bytes.
• ICMP payload: 333 bytes.

Total: 361 bytes.

Expected detection

After generating the test traffic, the NTA should generate the following alert:

Test Alert using ICMP size 333 for NTA validation

View this alert in the NTA Alerts panel. Refer to Alerts for more information.

• The detection is triggered by the ICMP Echo Request. A reply from the destination host is not required.
• The test signature does not affect traffic analysis or detection accuracy and is safe to use for validation.

If no alert is generated

If no alert is shown after generating the test traffic, verify the following:

• Test traffic was generated from a network segment monitored by the NTA.
• Traffic from the source network is mirrored to the NTA.
• The NTA is receiving traffic on the monitoring interface.
• The ICMP Echo Request used the correct 333-byte payload size.
• Sufficient time has been allowed for the alert to be processed and displayed.

If all checks pass and no alert is generated, submit a ticket through the SamurAI Portal.

Delete an NTA

To delete an NTA:

1. In the SamurAI Portal, select Telemetry, and then select Network Traffic Analyzer.
2. Select the relevant NTA.
3. Select the More options icon and then select Delete NTA.
4. Review the warning. To confirm the destructive action, enter DELETE and select Delete NTA.

What’s next?

You have now deployed and configured your NTA. Refer to NTA Details.

3 - NTA Details

In this article all elements of the Network Traffic Analyzer are outlined to help you understand the panels available.

List all NTAs

1. Login to the SamurAI Portal

2. Click Telemetry and select Network Traffic Analyzer from the main menu

3. A list of all NTAs will be displayed. Various fields are displayed based on information you included when creating the NTA.

4. Click on an entry to drill into an NTA’s details.

General

The General panel of an NTA provides an overview of the NTA and status.

NTA Status

Current Status

The Current Status widget provides a visual representation of the CPU, Memory and Disk usage of the NTA. Each metric is displayed as a half-donut chart, offering a quick visual snapshot of system load.

This widget may also include status messages of individual components of the NTA, this will assist with identifing any problems and should be included if you submit a ticket with the SamurAI SOC.

NTA Notifications

The SamurAI platform will send email notifications to registered users should your NTA status change to Critical. Once any issues have been resolved, you will also be notified again when rectified. Users have the option to enable or disable notifications.

Additionally the SamurAI platform will send push notifications if the SamurAI Portal is installed as an app (Progressive Web App - PWA) and notifications are configured within user settings.

Enable or Disable Notifications

1. From the NTA Table view, click on More Options () to the right of the NTA View
2. Select Notifications Settings
3. Toggle the setting to enable or disable by selecting the relevant icon per listed NTA. Alternatively you can select the default setting (send notification).
4. Click Save.

You can also achieve this per individual NTA by:

1. From the NTA Table view, click on More Options () to the left of the NTA.
2. Select Notifications
3. Toggle the setting to enable or disable by selecting the relevant icon. Alternatively you can select the default setting (send notification).
4. Click Save.

System Information

The System Informatiom panel displays important NTA system information and metrics including:

System

Storage

Network Management

Network Monitoring

Metrics

All metrics displayed are by default over the past 2 hours however you can adjust via the Time Picker

Alerts

The Alerts panel displays security detections made by the NTA.

You do not have to act on any alerts as the SamurAI SOC analysts triage, investigate and validate alerts as part of the Managed Detection & Response (MDR) service.

As alerts are validated by the SamurAI SOC analysts and investigated, they may potentially lead to a reported Security Incident and are marked accordingly. Our strategy includes visibility and transparency of the service we provide to you therefore this feature provides you that visibility showcasing the value of the NTA and service.

Alerts Summary

Alerts are summarized in a panel which can be updated based on a specified time period and includes:

• Security Incidents - the total number of security incidents reported to you that may correspond to one or more alerts.
• Alerts - the total number of alerts detected by the NTA.
• Real-time engine- the total number of alerts created by the NTA resident SamurAI real-time engine.
• Vendor - the total number of alerts created by the NTA resident Intrusion Detection System (IDS) - Suricata.

Filters

Various filters are available to determine the alerts to be displayed.

Figure 1: Time and Display filter

The total number of alerts within the alerts table in displayed to the left of the Time Period filter.

Time period

You can update all panels to specific date and time ranges. We default to the Last 24 hours however have included Quick time ranges.

Figure 2: Date and time selection

Display Filter

Enter any values you wish to filter and highlight within the display filter.

Figure 3: Display filter

Alert Column Filter

Adjust and show/hide any of the column values within the Alert Table.

Figure 4: Alert column filter

Alerts Table

All alerts related to the NTA are listed within the alert table, it is important to note is that the table is limited to 10,000 alerts therefore apply filters to narrow the results.

For description of each field within the Alert table refer to Alerts Table