McAfee Network Threat Response

vul_mgr_frt_lg

McAfee Network Threat Response discovers zero-day malware that will use or is using network exploits to attack your network, and then automatically captures that malware for analysis and response. Install the appliances and immediately start detecting malware unique to your internal network. Get full visibility of discovered malware through the Network Threat Response control center dashboard. Integration with McAfee host-based malware technology automatically keeps your threat database up-to-date. The McAfee Network Threat Response sensor appliances scan your organization's network traffic looking for new malware payloads and bot distribution websites, including DNS fast flux, which eliminates the changing IP address problem of sophisticated attacks.

Overview
Features and Benefits
Model Specs
Data Sheets

McAfee Network Threat Response (NTR) is an out-of-band appliance that captures, deconstructs, and analyzes malware specific to your own network. McAfee NTR is a powerful tool for security analysts. It automatically identifies malware targeting internal network vulnerabilities, and instantly captures and analyzes it to aid remediation. The McAfee NTR appliance sits inside your network and streamlines the forensic threat analysis process with the following features:

Find: McAfee NTR finds malware activity in real time and even decodes polymorphic encoders. The Network Threat Response Control Center dashboard provides full visibility into discovered malware.
Create: McAfee NTR creates analysis to help you better understand the malware, how it is attacking your network, and its payload.
Prevent: McAfee NTR helps you update your security posture by capturing malware and automatically sending samples to McAfee Artemis Technology, McAfee’s host-based malware protection technology. Updated .DAT files are then pushed out to all protected systems within minutes. These shared signatures bring the full power of McAfee Labs research to McAfee NTR. McAfee NTR offers exceptional integration with McAfee Firewall Enterprise.

Benefits:

Give security analysts a powerful forensic tool
Get deep visibility into the threat context inside your network. McAfee Network Threat Response (NTR) provides the specific data you need to develop security strategies and protect your network from malicious activity and targeted attacks unique to your environment. For example, McAfee NTR can examine a series of packets to characterize an attack, discover malware payloads embedded inside an otherwise-innocuous PDF file, analyze payloads, and even re-create the series of packets that attempted to obfuscate the threat.
Characterize unknown threats
Find new network activity and new behaviors unique to your network to accelerate malware analysis and threat response. McAfee NTR’s network-based technology focuses on identifying, collecting, reverse engineering, and labeling malware and bots. It provides real-time capture and analysis of malware and threats inside your network, and determines what occurs after the initial labeling or characterization of an attack. For example, if you’re already using intrusion prevention, your IPS may block a threat by dropping the traffic, but it has limited ability to go back and analyze the threat that was blocked (dropped).
Automate the response process
Reduce time spent sifting through thousands of threat alerts. McAfee NTR shows you confirmed attacks. All network traffic is labeled. Encoded data is decoded. By using a unique embedded data-coupling process, McAfee NTR confirms the appearance of vulnerabilities and exploit attempts. Other analysis solutions may help track threats back to their original sources, but only McAfee NTR dissects the threat in near real time to understand how a targeted attack specific to your network is entering the network, how it is operating, and how it is trying to spread. When NTR discovers both a vulnerability and a means to exploit it in the same stream, it confirms the attack.
Reduce the sensor-to-analyst ratio
Automate tedious manual examinations, enabling experienced security analysts to focus on new, abnormal, and unique network activity. By providing metadata signatures with built-in correlation elements, such as data coupling, McAfee NTR streamlines security event detection, validation, and reporting.

Features:

Instant threat response
Identify malware using network exploits to move on your internal network. McAfee Network Threat Response captures malware for analysis and response. This stream-based solution rapidly decodes payloads, intercepts and downloads malware, and provides detailed analysis. It checks packet headers for abnormalities and can even replay the attack, if desired. For example, McAfee NTR can identify that a PDF file that appears innocuous actually contains portions of malware that are part of a sophisticated, obfuscated attack.
Unique signature database to block attacks
Trust a large signature database, as well as templates, to stop attacks. The SNORT-compatible malware signature database contains more than 18,800 signatures, and 200 new signatures are added each month. McAfee NTR helps create new signatures to block future attacks. You can even add your own SNORT-compatible signatures.
Easy integration with McAfee network security solutions
Get complete protection against malware. McAfee NTR typically works in conjunction with an enforcement appliance like McAfee Network Security Platform (NSP/IntruShield) or McAfee Firewall Enterprise (Sidewinder). New malware is captured and sent to McAfee Artemis Technology to prevent further infection. When McAfee NTR is deployed in conjunction with an inline IPS system (NSP) and a firewall (FW), it provides complete attack coverage for malware unique to your network.
Streamlined web-based management
Reduce overhead and save time with simple, centralized management. The McAfee Network Threat Response Control Center is a web-based management console that manages multiple NTR sensor appliances. Control Center is also installed on each sensor appliance for single-box evaluation.

Key Advantages

Unique to your network

Finds new behaviors unique to your network, activity you have never seen before, accelerating your analysis and response against targeted attacks.
Shows you confirmed attacks, malware payloads and BOT distribution websites

Reduce analyst-to-sensor ratio

The ability to analyze data quickly leads to the need for fewer SOC / CERT level 1 and 2 analysts
Ability to add new modules for specific emerging threats: java script messaging, shell code detection, etc.

Reduce time-to-respond

Finds malware and automatically sends info to McAfee’s host protection
Prevent by pushing out updated .DAT file within minutes or import into NSP

Implements a process

Process framework for determination of false negatives
Cross correlation
Tertiary detection (decoy)

More value through integration

Compliments McAfee Network Security Platform (IntruShield) by detecting and analyzing the unknowns
Integrates with McAfee host-based malware protection to provide up-to-date attack signatures

Reliable, network-class platforms; next-generation network protection

Performance from 50 Mbps up to 10 Gbps

Ease of deployment

Installing the Network Threat Response appliance takes only a few minutes.

Models	A50	ACC	A50VM
Role	Sensor Appliance	Management Console Appliance	Sensor Virtual Machine
Performance throughput	Up to 500 Mbps	Multiple Sensors	Up to 500 Mbps
Ports
1 Gigabit Ethernet ports	3	0	—
10 Gigabit Ethernet ports	0	0	—
Dedicated management ports (1 GbE)	1	4	—
Mode of Operation
SPAN port monitoring (passive)	Yes	—	Yes
Network TAP mode (IDS)	Yes	—	Yes
Decoy mode (honey pot)	Yes	—	Yes
Packet Filter mode w/fail open	No	—	No
Virtual Machine	No	No	Yes
Hardware
Dell PowerEdge	R200	R610	VMware ESX Image
CPU Cores	4	8	—
CPU	1x Intel X3360 Xeon Quad Core chip 2.83GHz	2x Intel Nehalem E5540 Xeon Quad-Core chips 2.53GHz	—
Memory	2GB	12GB	—
Hard Drives	1x 250GB SATA	4x 300GB Serial-Attached SCSI	—
Onboard NICs	2x 1GbE	4x 1GbE	—
Additional NICs	Dual Port 1GbE NIC (copper)	No	—
NetLogic Card	No	No	No
Operating System	RHEL 5	RHEL 5	RHEL 5
High availability
Redundant power	No	Yes	—
RAID Level	No	RAID-10	—
Physical
Form Factor	1U	1U	—
Chassis Dimensions	1.68"(H) x 17.60" (W) x 21.50"(D)	1.68"(H) x 19.99" (W) x 30.39"(D)	—
Shipping Dimensions	35.00"(W) x 10.25"(H) x 24.75"(D) each	37.50"(W) x 11.50"(H) x 24.25"(D) each	—
Weight	26 lbs.	39 lbs.	—
Power consumption	345w	717w	—
Power input	90–264VAC (47-63Hz)
Temperature	10° to 35° C (operating), -40° to 65° C (storage)
Relative humidity (non-condensing)	20% to 80% (operating), 5% to 95% (storage)
Altitude	-50 to 10,000 feet (operating), -50 to 35,000 feet (storage)
Safety certification	NRTL (USA), CE (Europe), IRAM, BELLIS, SCC (Canada), CNCA or CCC, KONCAR, TUV, IECEE CB, SII, OTAN - CKT, KEBS, NYCE or NOM, INSM, SONCAP, NEMKO, GOST, KSA ICCP (R610 only), NRCS / SABS, BSMI, UKRTEST or UKRSERTCOMPUTER, STZ
EMI certification	Class A for: FCC (USA), CE (Europe), ACMA or C-Tick, BELLIS, KVALITET, ICES (Canada), CNCA or CCC, KONCAR, SII, VCCI, OTAN - CKT, INSM, NEMKO, GOST, SABS, KCC / BCC, BSMI, UKRTEST or UKRSERTCOMPUTER, ICT

Models	A1000	A200	A100
Role	Sensor Appliance	Sensor Appliance	Sensor Appliance
Performance throughput	Up to 10 Gbps	Up to 2 Gbps	Up to 1 Gbps
Ports
1 Gigabit Ethernet ports	7	7	3
10 Gigabit Ethernet ports	2	0	0
Dedicated management ports (1 GbE)	1	1	1
Mode of Operation
SPAN port monitoring (passive)	Yes	Yes	Yes
Network TAP mode (IDS)	Yes	Yes	Yes
Decoy mode (honey pot)	Yes	Yes	Yes
Packet Filter mode w/fail open	No	Yes	No
Virtual Machine	No	No	No
Hardware
Dell PowerEdge	TBD	R610	R610
CPU Cores	16	8	4
CPU	4x Intel Nehalem Quad-Core chips 2.66GHz+	2x Intel Nehalem E5540 Xeon Quad-Core chips 2.53GHz	1x Intel Nehalem E5540 Xeon Quad-Core chip 2.53GHz
Memory	24GB	12GB	6GB
Hard Drives	4x 300GB Serial-Attached SCSI	4x 300GB Serial-Attached SCSI	2x 300GB Serial-Attached SCSI
Onboard NICs	4x 1GbE	4x 1GbE	4x 1GbE
Additional NICs	Dual Port 10GbE NIC (fiber) Intel Quad Port 1GbE NIC (copper)	Intel Quad Port 1GbE NIC (copper) w/fail open	No
NetLogic Card	NLS2008HAP	No	No
Operating System	RHEL 5	RHEL 5	RHEL 5
High availability
Redundant power	Yes	Yes	Yes
RAID Level	RAID-10	RAID-10	RAID-1
Physical
Form Factor	4U	1U	1U
Chassis Dimensions	6.8"(H) x 17.6" (W) x 27.6"(D)	1.68"(H) x 18.99" (W) x 30.39"(D)	1.68"(H) x 18.99" (W) x 30.39"(D)
Shipping Dimensions	TBD	37.50"(W) x 11.50"(H) x 24.25"(D) each	37.50"(W) x 11.50"(H) x 24.25"(D) each
Weight	92 lbs.	39 lbs.	39 lbs.
Power consumption	1570w	717w	717w
Power input	90–264VAC (47-63Hz)
Temperature	10° to 35° C (operating), -40° to 65° C (storage)
Relative humidity (non-condensing)	20% to 80% (operating), 5% to 95% (storage)
Altitude	-50 to 10,000 feet (operating), -50 to 35,000 feet (storage)
Safety certification	NRTL (USA), CE (Europe), IRAM, BELLIS, SCC (Canada), CNCA or CCC, KONCAR, TUV, IECEE CB, SII, OTAN - CKT, KEBS, NYCE or NOM, INSM, SONCAP, NEMKO, GOST, KSA ICCP (R610 only), NRCS / SABS, BSMI, UKRTEST or UKRSERTCOMPUTER, STZ
EMI certification	Class A for: FCC (USA), CE (Europe), ACMA or C-Tick, BELLIS, KVALITET, ICES (Canada), CNCA or CCC, KONCAR, SII, VCCI, OTAN - CKT, INSM, NEMKO, GOST, SABS, KCC / BCC, BSMI, UKRTEST or UKRSERTCOMPUTER, ICT