CySight

This capability provides short-term and long-term comparative analysis of every network element, including IP, interface, or application. Comparisons span flexible periods, allowing rapid identification of which element caused a change and when, optimizing decision-making on server positioning and service provisioning.

CySight features the ability to conduct analysis on simultaneous data fields, such as usage, packets, flows, and utilization, with full sorting flexibility. This includes packet size, full flow, and deviation analysis, allowing quick identification of excessive multi-threaded conversations, network 'noise,' or changing application usage trends.

This powerful add-on provides the capability to create any combination of intelligent baselines for comprehensive anomaly detection. The platform is preset with default alerts designed to flag unusual activity, dramatically reducing the manual effort required to identify high-risk events, and enabling proactive security analysis.

This functionality allows users to create custom analyses and automate the output either as a periodic report or an alert. Reports can be emailed or saved for compliance and trending at scheduled intervals. Alerts are tunable to reduce false positives and can utilize SNMP traps to raise trouble tickets when thresholds are exceeded.

CySight can be highly tuned to collect only the data required by the organization, optimizing performance. This allows control over granularity, collecting per-minute data for critical forensic segments and less frequent hourly data for high-level reporting. Self-maintaining rules protect the server in the event of major flow-intensive network anomalies.