Device Manipulation
The device in the system contains a lot of information:
- Device hardware and firmware information.
- Device connections, mini map indicating relationships with other devices, protocol pie chart.
- Device current open port/protocol.
- Device vulnerability. (unpatched/patched/potential)
- Device alert and connection alert.
- Device update history.
So this page describes how user can interact with device in the system.
Create Device
Usually, device is created automatically by Neuralyzer during discovery phase. However, there is some devices Neuralyzer can’t discover (Ex: access switch). In this case, user can also create new device manually by clicking on “Create device” button at Assets or Map page.
User can add more NICs if the device has multiple NIC cards.
Edit Device
User can edit the device properties even after Neuralyzer completely scans. The new properties that user edited will have higher priority and will not be overridden when Neuralyzer scanning the device information again. At this time, “New properties detected**” will appear so that user can know Neuralyzer has detected the new device information. User can choose which property should be overridden.
Clone Device
This would be the same rule with creating device.
Device detail - Connection
You can see more detail about the device by clicking on Detail button.
On connection tab, you can see all other devices that are connecting to the current device on the mini map and the total connection by protocols. You can quickly open another device by double-clicking on the node.
The connection list shows all connection that the device have communicated.
You can sort or search any information related to the connection.
Device detail - Open port/protocol
The open port/protocol tab indicates the current open port/protocol on the device with some information:
- Port: open/closed port.
- Protocol: protocol is using.
- Last seen open: the last time that port opens.
- Last seen close: the last time that port closes.
- Current state: current state of port.
- Possible misconfigurations: when port open but no actual traffic or violate any open port policies.
- Recheck: check possible misconfigurations.
Device detail - Vulnerability
The open port/protocol tab indicates all CVEs that the device is being/may be unpatched.
- Unpatched: the CVEs that device is not patched.
- Patched: the CVEs that device have resolved.
- Potential: the CVEs that device may not be patched.
You can see more information by click on the CVE.
- CVSS version 3.x or 2.0
- Last detected and resolved time.
- CVSS Score.
- CVE remediation document.
- Vector.
Device detail - Alert
Alert list page includes 2 tabs: Connection alerts list and Device alerts list.
You can click on the link for more detail.
Device detail - Update History
This tab indicates that what field of device has been updated.
There are two factors that can change device properties:
- By system, Neuralyzer updates device properties automatically during discovery/scanning.
- By administrator, user is able to update the device information so that Neuralyzer can learn and update the device information for the next time scanning that devices.
Note: The device changes make by administrator will have higher priority than the system.
Device learning mode
Action on device learning mode:
- Extend: extend learning hours of specific device.
- Complete: complete learning phase of device immediately.
- User is able to force complete learning for all devices by turning on Anomaly Detection.
The device will be put in learning mode in case:
- Before turning on Anomaly Detection, at the first time starting Neuralyzer, all devices will be put in learning mode.
- After turning on Anomaly Detection, a new device that connect to the system will be put in learning mode.
- Or user want to extend learning time.
Note: The device and it’s connections will not be alerted during learning mode.
Field Device
Neuralyzer haven’t supported scanning field device yet. So user need to create field devices manually.
User is able to link field devices to one or more controller by clicking “Link to Controller” button then click on “+” button and choose the controller that scanned by Neuralyzer.
