Detecting what agents cannot see, from the network itself

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

NetWatch reads connection metadata from a passive sensor and detects beaconing, DNS tunnelling, large uploads, lateral movement and exposed services — for every device on the wire, including the ones that can never run an agent.

2The challenge

Printers, cameras, appliances and unmanaged laptops cannot run an agent, and attackers know it. What they do still crosses the network: implants call home on a timer, data leaves in large uploads, and admin protocols move from host to host.

The TotalHeal approach. NetWatch runs on the same passive sensor as IndustrialGuard. It reads connection metadata from a SPAN or TAP port, detects command-and-control, exfiltration and lateral movement, learns a host inventory from the traffic and raises alerts in the same incidents as your endpoint, identity and cloud alerts.

3Architecture

4How it works

1. MirrorConnect the sensor to a SPAN or TAP port.
2. LearnHosts, services and software versions from the traffic.
3. DetectEight detections for C2, exfiltration, movement and exposure.
4. RespondBlock through your firewall, behind approval.

5Capabilities in detail

• Passive sensorA Linux host on a SPAN or TAP port; nothing is installed on the hosts it watches.
• Command and controlBeaconing (regular call-backs) and DNS tunnelling.
• Data leavingLarge uploads to outside addresses.
• Lateral movement and scansAdmin services (SMB, RDP, SSH, WinRM) used host to host, and internal scans.
• Exposure and weak protocolsRemote administration reached from the internet, clear-text logins and self-signed certificates.
• Host inventory from trafficNames and MAC addresses (DHCP), services and software versions seen on the wire.
• Response through your firewallBlocking goes through the TotalHeal firewall connectors, behind your response policy.

6Security and data handling

• PassiveNothing is installed on watched hosts.
• Metadata, not contentEncrypted content is not inspected or stored.
• People approve blocksBlocking follows your response policy.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A Linux host with a SPAN or TAP port
• The TotalHeal collector

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.