Network Behavior Anomaly Detection (NBAD)

The NBAD section provides behavioral anomaly monitoring, protocol metrics, flow maps and attack telemetry across your network.

Before you start

NBAD dashboards are provided by Trisul Apps. Install them first. See Enabling NBAD.

Set up

• Enabling NBAD — Install the Trisul Apps that provide the NBAD dashboards.
• NFGen Flow Conversion — Export flow records as NetFlow or IPFIX.

NBAD dashboards

• Layer 7 Metrics — Application-layer breakdown of traffic, SNIs, and TLS root CAs.
• HTTP Traffic — Detailed HTTP method, status code, and URL visibility.
• IPv4 / IPv6 Dashboard — Side-by-side protocol transition tracking.
• Tunnels — Encapsulated and tunneled protocol detection.
• P2P Analytics — Peer-to-peer traffic inspection.
• JA3 Fingerprints — JA3 hashes of observed TLS ClientHello messages.
• JA4 Fingerprints — JA4 fingerprints of observed TLS ClientHello messages.
• TCP Analyzer — TCP health, retransmission, and latency diagnostics.
• Flow Map — Live global geographic traffic mapping.
• MITRE ATT&CK — Adversary technique mapping and alert timeline.
• DDoS Monitor — Volumetric spike and flood detection.
• DNS Flood Activity — DNS and TCP SYN flood pattern tracking.

Tasks

• Common Tasks — Short recipes for the NBAD dashboards.
• Reducing False Positive Alerts — Suppress noisy Suricata signatures.