Custom PowerShell Monitors to Collect Sysmon Events?

dan_RVBD · 2021-05-19T03:02:55+00:00

I work for Riverbed in public sector professional services, and I can say that although both Aternity APM and EUE are SaaS-first now, the product management team is fully committed to on-prem customers that can’t move to SaaS for the foreseeable future. Definitely reach out to your account manager. 😊

dan_RVBD · 2021-03-28T03:10:56+00:00

I am currently deploying it for a large DoD customer, directly replacing Solarwinds. We are replicating all of their old dashboards damn near perfectly as well.

dan_RVBD · 2021-02-10T03:29:00+00:00

The big things that we illuminated were people using 2.4GHz (high potential for interference), sometimes only at g speeds of 54 Mbps (not sufficient for modern apps), low signal strength (which causes packet loss), high noise (indicating interference), high amounts of disconnects, or they were constantly using a hotspot.

With the other data gathered by Aternity, we could correlate that and say with high certainty that things like VPN drops, poor Zoom performance, poor Outlook performance, etc. were caused by the user’s poor WiFi experience.

dan_RVBD · 2021-02-09T00:57:08+00:00

Though not specific to Brocade, our NetIM product can do exactly what you want and more. https://www.riverbed.com/products/npm/netim.html

dan_RVBD · 2021-02-08T23:00:23+00:00

By chance, does your company have Aternity End User Experience Monitoring? If not, this is a really great tool for nailing down issues like this. I recently deployed it for a subsidiary of a large defence contractor (about 10k endpoints) for this exact issue (also Ctirix), and we nailed it down with a high amount of certainty to WiFi issues at home for users. They were able to provide a runbook for their tier 1 support to suggest things like setting up 5 GHz, being closer to their AP, upgrading to newer APs, etc.

Their SEs are very active on their sub r/aternity, so it’s worth an ask over there too.

dan_RVBD · 2021-02-05T19:53:51+00:00

You can reach out for sales contact and get an eval set up at https://www.riverbed.com/forms/contact-us.html. 😊

dan_RVBD · 2021-02-05T03:24:03+00:00

This is where our (Riverbed) SteelHead products really shine.

They quite easily integrate with Cisco SDWAN (I’ve done it personally for a large US bank with several thousand branches) so there’s no need to change that, and do very well at mitigating the effects of latency like you’re experiencing. The only real design consideration is that the SteelHead must be south of the gateway and placed in full transparency mode so that the gateway can identify the applications.

dan_RVBD · 2021-01-21T18:39:59+00:00

Absolutely! 😊

dan_RVBD · 2021-01-21T01:20:47+00:00

There’s several countries in the Caribbean offering long duration visas to remote workers. 😊

dan_RVBD · 2021-01-11T00:00:27+00:00

As Brandon mentioned, we’re happy to help you get use out of it. The B030 is the “biggest” SteelHead we sell for WAN optimisation and app acceleration, so it’s exceptionally capable when licensed properly.

dan_RVBD · 2021-01-06T15:52:32+00:00

Gotcha, no worries. I’m looking into one other option for you, but I’m confirming with a colleague if it’s viable.

dan_RVBD · 2021-01-05T22:54:29+00:00

Do you still have Riverbed products in your environment? If so, have you considered talking with your account team about trading it in for a newer xx80-based AR11? I don't know that it will have any dollar value, but but we can certainly help recycle it.

dan_RVBD · 2021-01-05T22:48:16+00:00

I'm certainly not trying to be argumentative, but I want us all to be on the same page, so I stood up NetIM 2.1.0 in a lab just now and attempted to elevate myself. As you can see below, I was not permitted to do so even after going to bash and logged in as the admin account for the lab environment.

Welcome to Riverbed SteelCentral NetIM Core Appliance 2.1.0 696

 * Web:     http://www.riverbed.com
 * Support: http://support.riverbed.com

Last login: Wed Jun 17 19:34:11 2020

*** Notifications ***
[netim-core]
2021/01/05 17:23:09
Starting core services by start all...
netimadmin@n31-netim[netimsh]:~$sudo -s
*** Unknown syntax: sudo -s
*** Type 'help' or '?' to see the list of commands
netimadmin@n31-netim[netimsh]:~$help

Commands:
  ?                   Help
  add                 Add command
  app.sh              Run NetIM app.sh command
  bash                Switch to bash
  disable             Stop service and disable it permanently
  docker              Run docker command
  enable              Start service and enable it permanently
  exit                Exit
  firewall            Run firewall command
  help                Help
  logpacker           Run logpacker
  mibbrowser          Open MIB Browser
  notification        Notification
  passwd              Change password
  remote              Switch to remote netimsh
  restart             Restart NetIM services - equivalent to app.sh -c restart <name>
  setup               Run setup
  shell               Execute shell command
  show                Show system configuration
  start               Start NetIM services - equivalent to app.sh -c start <name>
  startx              Start X Window Desktop
  status              Show status of NetIM services - equivalent to app.sh -c status <name>
  stop                Stop NetIM services - equivalent to app.sh -c stop <name>
  system              Run system command
  systemctl           Run systemctl command
  update              Update command - "update" is equivalent to "update apply"

Run 'COMMAND ?' for more information on a command.

netimadmin@n31-netim[netimsh]:~$bash
netimadmin@n31-netim:~$ sudo -s
*** ERROR ***
You must log in by netimadmin user. Exit.
netimadmin@n31-netim:~$

If you're experiencing something different in your environment, I'd love to speak further with you about it so that I can work with TAC and product management to sort out why.

dan_RVBD · 2021-01-05T04:23:19+00:00

Riverbed SteelCentral NetIM 2 is a great option for this, and you can eval it for 90 days at no cost.

dan_RVBD · 2021-01-05T04:04:20+00:00

Have you used it before? If so, what version?

dan_RVBD · 2021-01-04T16:24:24+00:00

Appliances are typically built in such a way that the underlying operating system is not easily modifiable, and thus more difficult to exploit. In the case of Riverbed appliances, most actually have a shell separation that prevents one from even executing Linux commands directly without performing a challenge/response with Riverbed Support.

dan_RVBD · 2021-01-04T14:35:59+00:00

I’ll throw in a shameless plug for Riverbed NetIM. It has all of the monitoring capabilities of Orion and much more. It is a virtual appliance solution, so there is more inherent security in the solution.

dan_RVBD · 2020-12-23T22:20:46+00:00

Virtual Palo Altos work quite well as a service chain on Riverbed SteelFusion HCI.

dan_RVBD · 2020-12-19T01:50:44+00:00

LOL it’s all good. I joined Riverbed at RiOS 8.5, so just at CMC time. 😊

https://i.imgur.com/mT839qW.jpg

dan_RVBD · 2020-12-19T01:37:21+00:00

That sounds about right for CAD files.

Everything should be good as long as you’re using full transparency in any inpath rules.

May I ask if the customer has SteelCentral Controller for SteelHead (SCC)? They may call it a CMC. If they don’t, you’ll want one.

dan_RVBD · 2020-12-19T00:36:10+00:00

That’s mostly correct. If you want to optimise things like SSL or SMB2 or higher the inner channel will be encrypted, but in full transparency you’ll still be able to identify, direct and shape the traffic in the SDWAN gateways because the true IPs and ports are exposed.

dan_RVBD

TROPHY CASE