Trisul NSM Guide
Welcome to the Trisul NSM Guide.
Trisul NSM analyzes raw packets for network security monitoring, traffic analysis, threat detection and packet-level visibility. It combines flow monitoring, full packet capture (PCAP), IDS alert correlation (Suricata/Snort), Network Behavior Anomaly Detection (NBAD) and protocol extraction.
With Trisul NSM, you can:
- Monitor and analyze network traffic in real time and retrospectively
- Detect security incidents, intrusions, and anomalous network behavior
- Correlate IDS alerts with raw packet captures and flow history
- Track top talkers, applications, conversation flows, and host endpoints
- Inspect protocols such as DNS, HTTP and SSL/TLS
- Investigate historical traffic without data loss
- Automate alerts and generate compliance and security reports
Before you begin
- Install Trisul. Follow the Quickstart.
- Send raw packets to the Trisul Probe from a SPAN or TAP port. See Configure Packet Capture.
- Log in to the Web UI and select Trisul NSM as the product mode. You choose the mode on first login, not during installation. See Selecting the Product Mode.
- Confirm that packets are arriving. Go to Dashboards → Real Time Traffic and check that the live traffic rate is above zero.
Some NSM features need extra setup:
- IDS alerts need an IDS such as Suricata or Snort sending alerts to Trisul. The MITRE ATT&CK prerequisites show how to install the Suricata app.
- NBAD dashboards need the NBAD apps. See Enabling NBAD.
When packets are arriving, use the rest of this guide to learn the NSM menus.
The screens and menus described in this guide are available when Trisul is configured in NSM mode. If you selected a different product mode, your Web UI may have a different menu structure.
What you will find in this guide
The NSM Web UI is organized into ten main menu categories. Each category helps you perform a different type of network monitoring or security analysis:
Start with Dashboards for a live view of your network, then check Security to see IDS alerts, then NBAD for behavior-based detections. These are the two menus that set NSM apart from NetFlow Analyzer. The rest of the menus below are for deeper investigation once you know what you are looking for.
🗃️ Dashboards
Use dashboards for a quick view of what is happening in your network. You can monitor current traffic, active hosts, applications, alerts, security information, sessions, and other frequently used network metrics.
🗃️ Retro
Use Retro when you want to look back at network activity that has already happened. It lets you inspect historical counters and analyze traffic for a specific period in the past.
🗃️ Tools
Use the Tools section when you need to investigate traffic in more detail. It includes flow exploration, historical trends, IP flow exports, usage charts, flow trackers, taggers, and edge connection graphs.
🗃️ Security
Use the Security section for access to monthly security summaries and unified alert views.
🗃️ Netflow
Use the Netflow section to understand where your flow data is coming from and how traffic is distributed across your network devices and interfaces. You can view NetFlow sources, exporters, routers, interfaces, and interface-level traffic details.
🗃️ Resources
Use the Resources section for deep protocol analysis, DNS, URL, and certificate inspection.
🗃️ Alerts
Use Alerts to identify traffic conditions that require attention. You can configure Threshold Crossing Alerts (TCAs), flow tracking alerts, blacklist matching, dynamic threshold bands, and view alert activity.
🗃️ Reports
Use Reports when you need to turn network traffic data into reports that can be reviewed or shared. This section includes standard reports, scheduled recurring reports, and email delivery settings.
🗃️ Customize
Use Customize to adjust the NSM Web UI. You can manage dashboards, modules, dashboard packages, Network FAQ questions and the navigation menu.
🗃️ NBAD
Use Network Behavioral Anomaly Detection (NBAD) for tracking protocol anomalies, Layer 7 metrics, DDoS, and MITRE ATT&CK telemetry.