cognitix Threat Defender

Introduction

• About this Documentation
  • Intended Audience
  • Conventions
  • Related Resources
• What’s new in this version?
  • Upgrade Compatibility
  • New Features and Improvements
  • Important Fixed Issues
  • Known Issues
  • Upgrade Instructions and Requirements
• Technical Concepts of Threat Defender
  • Behavior-based Correlation
  • Event Tracking Tables
  • Threat Intelligence
  • Network Segmentation
  • Connection Tracking

Installation and Setup

• System Requirements
  • Preconfigured Hardware Systems
  • Other Hardware Systems
• Installation Preparation
• Installation via USB Installer Drive
  • Setup
  • Result
• Network Integration
• Signing In
• Changing the Administrator Password
• Completing the Setup
  • Adding a License
  • Changing the Hostname and Time Settings
  • Creating New System Users
  • Changing the Management Interface
  • Configuring Proxy Settings
  • Updating cognitix Threat Defender
  • Defining Update Schedules
  • Setting up the User API for User Mapping
  • Managing the Processing Interfaces
  • Backing up the Configuration

Usage

• Basic Usage
  • The User Interface
  • Discovering the Network
  • Creating Static Network Objects
  • Creating Dynamic Network Objects
  • Creating Global Rules
  • Creating Correlation Scenarios: Blocking TCP Port Scanners
  • Viewing the Content of Event Tracking Tables
  • Using Asset Tracking
• Advanced Usage
  • Using Network Segmentation
  • Using Behavior-based Correlation
  • Exporting Reporting Data to Elastic/ELK

Interface Reference

• Analytics
  • Overview of the Analytics Dashboards
  • Network
  • Assets
  • Policy
• Policy
  • Rules
  • Advanced Correlation
  • Network Objects
  • Schedules
  • Event Tracking Tables
• Inventory
  • Assets
  • Asset Logs
  • Asset Setting
  • Users
  • User API Logs
  • User API Setting
  • Backup/Restore
  • Data Export
• Threats
  • Overview
  • Incident Logs
  • Intelligence Database
• Network
  • Overview
  • Manage Processing Interfaces
• Logging
  • Audit Logs
  • Audit Log Channels
  • Report Channels
  • Local Logs
• Settings
  • General
  • Monitoring
  • System Users
  • Updates
  • Update Schedules
  • License
  • Configurations
  • System Actions
• Diagnostics
  • Overview
  • System Health
  • Troubleshooting
  • Flow Table Reporting
  • MAC Table Reporting

Appendix

• Access Rights by User Roles
• JSON Lines Formatted Output
• IPFIX Specification
  • IPFIX Setup
  • IPFIX Records
  • cognitix IPFIX Enterprise Elements
  • cognitix Threat Defender IPFIX Events
  • Common Event Fields
  • Policy Rule Match Field
  • Log Action Fields
  • URL Classification Fields
  • IPS Rule Hit Field
  • IPFIX Event Content
• syslog Specification
  • syslog Setup
  • syslog Messages in General
  • syslog Datasets
  • cognitix Threat Defender syslog Message Types
• Flow Table Reports
• IPS Rule Definitions
  • Metadata Keywords
  • Payload Keywords
  • Flow Keywords
  • HTTP Keywords
  • SSL/TLS Keywords
  • Thresholding Keywords
• Previous Releases
  • 20201014.0
  • 20200805.0
• Glossary

---

Imprint

cognitix Threat Defender version 20201008.2.0.0

© Copyright 2020 genua GmbH. All rights reserved.

genua GmbH Domagkstraße 7

85551 Kirchheim, Germany

Phone: +49 89-991950-0

Fax: +49 89-991950-999

genua acknowledges all trademarks in this document. cognitix, genua and the genua logo are registered trademarks of genua GmbH.