TRITON RiskVision Setup Guide
5
Introducing TRITON RiskVision
How does RiskVision work?
The RiskVision monitoring and analysis process works as follows:
1.
Capture
monitors IP packets from a single network interface and stores them in
memory.
2.
Assembler
reads the pcap files provided by Capture and:
Identifies HTTP and SMTP transactions
Properly orders packets and removes duplicates
Writes HTTP and SMTP request and response data to disk for further
processing
3.
Transaction Processor
takes the request and response files provided by
Assembler and provides them to each of the Local Analysis plugins on the
appliance.
If any plugin identifies a transaction as malicious, suspicious, or violating a
data loss or data theft policy an incident is created.
If any plugin recommends that a transaction receive Cloud Analysis, an
incident is created.
By default, if no incident is created, the transaction is discarded.
4.
Data Server
is responsible for storing, retrieving, and analyzing data in the
Incident and Reporting Database. It also makes data available to other services for
further analysis (Plugin Manager), display to administrators (Local Manager), and
report generating (Reporting Server).
