And it does not require deep expertise – which means even junior analysts can perform packet forensics tasks. This makes investigating historical events fast, and far more efficient.

Simply select traffic of interest in EndaceVision and with a single click extract malicious files, or generate detailed log data from all the selected packets. With our latest software release (OSm 7.1), we’ve made it easy for even junior analysts to extract useful information from recorded packet data without requiring deep knowledge of packet structures and decode tools. This has made it difficult for less experienced analysts to extract value from packet data and often meant issues requiring packet forensics piled up on the desks of senior analysts to investigate. In the past packet analysis has required deep expertise and experience with tools like Wireshark or Zeek used to extract essential information from the recorded packet data.

Analysis of packet data is done on EndaceProbe appliances at the place it was recorded using hosted Wireshark without having to download or transfer large. With EndaceVision, analysts can rapidly zoom the timeline in-and-out to look at pre-cursor or post event activity to understand the full scope of any event or alert. pcap files so they can be opened up in Wireshark®. That can save hours of time extracting, downloading and carving-up massive. Our integrations with partner solutions focus on making it quicker and easier for analysts to find and analyze the packet data they need to investigate and resolve incidents.Īnalysts can go from an issue or alert in their security or performance monitoring tools directly to the related packet data in InvestigationManager™ with a click of the mouse. Recorded network traffic is now faster to search from within existing security tools such as SIEM or SOAR, and extraction of files and other important information can be done by any team member with the click of a mouse. Such skilful analysts can be a rare breed, so we have taken that expertise and packaged it into our latest EndaceProbe software. The challenge has been locating a packet guru with the skills to search and analyse recorded traffic to extract the vital evidence needed to resolve the issue at hand. Recorded network traffic often holds vital clues required to resolve serious Cyber Incidents, or difficult network or application issues.

Extracting files and other information from recorded packet dataīy Cary Wright, VP Product Management, Endace

Wireshark network monitoring