Ask your AI a network question

{ "devices": 42, "up": 41, "warning": 1, "down": 0,
  "warnings": [
    { "device": "fw-edge-01", "reason": "WAN interface utilization 94% (30-min avg)" }
  ] }

{ "top_talkers": [
    { "ip": "10.10.4.61", "avg_mbps": 612.4, "direction": "outbound" },
    { "ip": "10.10.2.8",  "avg_mbps": 88.1,  "direction": "internal" },
    { "ip": "10.10.4.23", "avg_mbps": 12.7,  "direction": "outbound" },
    "…" ] }

{ "device_id": 118, "label": "WKS-ENG-14", "ip": "10.10.4.61",
  "profile": "Windows Workstation (Agent)", "tags": ["workstation", "engineering"],
  "agent": { "enrolled": true, "version": "7.0.20" },
  "switch_port": { "device": "core-sw-01", "port": "Gi1/0/14" } }

{ "flows": [
    { "dst": "203.0.113.181:443", "proto": "tcp", "bytes": "21.4 GB",
      "dst_name": "ingest-us2.cloudvault.example" },
    { "dst": "10.10.2.8:445", "proto": "tcp", "bytes": "310 MB" },
    "…" ] }

{ "processes": [
    { "name": "CloudVaultSync.exe", "cpu_pct": 11.2, "read_mb_s": 74.8, "user": "SYSTEM" },
    { "name": "chrome.exe", "cpu_pct": 3.1, "read_mb_s": 0.2 },
    "…" ] }

{ "alerts": [
    { "label": "Device down — all devices", "class": "legacy", "enabled": true },
    { "label": "Syslog: FortiGate critical events", "class": "syslog_log", "enabled": true },
    "…" ],
  "note": "no interface-utilization alert found for fw-edge-01 WAN" }

Five calls from the complaint to the process responsible, and no dashboards opened along the way: fleet state, top talkers, the host behind the address, where its traffic was going, and what was running on it. Netmon already had the flow records, the switch-port mapping and an agent on the host. The assistant did the reasoning; Netmon supplied the evidence.

A vague question with a large number behind it. The sequence below is the one an analyst would follow by hand; here each step is a single tool call.

1. Fleet status first

   overwatch_summary({})

   90 devices and 12 open alerts, all medium and all single-device ping alerts on access points, printers, a switch, a server and two UPS units. Availability is a separate question; nothing here points at a security event.

2. Event counts by severity

   log_severity_summary({stream: "eve", hours: 168})

   1,224 high-severity IDS events in seven days, against 239 medium and 577 low. The high-severity count is the one to explain.

3. The newest high-severity events

   eve_search({hours: 168, severity: 1})

   All 25 of the newest share one source, one destination and one port: 10.10.1.88 → 10.10.1.31:902. Six rule families are involved, including log4j remote-code-execution and shellcode signatures. Six unrelated rules firing on a single flow is more consistent with content that happens to contain the matched byte sequences than with an exploitation attempt, but at this point that is a hypothesis, not a finding.

4. One address across every stream

   search_ip({ip: "10.10.1.88", hours: 24})

   709 IDS events and 821 flow records in 24 hours, one ARP entry, no syslog and no Windows event log. The host is not in the inventory: the ARP entry has no device attached, and the MAC’s OUI belongs to VMware. It is an unmanaged virtual machine that Netmon knows only from ARP and flow.

5. Traffic volume

   top_bandwidth({minutes: 1440})

   The same host is the largest source of traffic on the network by a wide margin: about a terabyte in 24 hours to one address, and a further 364 GB to 10.10.1.31, the destination of the alerts. Sustained volume at that scale is characteristic of a scheduled transfer rather than an attack.

6. One event in full

   eve_get({id: 3715})

   A single flow carrying 3.7 million packets and 5.5 GB toward the destination. The payload is 54% printable and Suricata could not identify the application protocol. Port 902 is VMware’s management data channel, and the shellcode rule that matched dates from 2010.

7. Assessment

   Not an intrusion. The evidence describes a scheduled bulk transfer, most likely a backup or replication job, whose content contains the short byte sequences the rules look for. Content-matching rules test for patterns anywhere in a stream, so a large enough transfer of the right kind of data will trigger them with no exploit present. Every observed property fits: one long-lived flow, one direction, high volume, an unidentified protocol on a VMware port, from a VMware guest.

8. Recommended actions

   Confirm the job with whoever owns the host, then suppress these signatures for that flow only, so a known-benign transfer stops producing 1,224 high-severity events a week and masking anything real. Add the host to the inventory: the largest traffic source on the network has no device record and no logs. Check that the transfer volume matches what the job is expected to move.

Six calls. The IDS events, the flow records, the ARP table and the inventory were queried from one system, which is what made the correlation quick.

The tools did not classify the traffic. They produced the evidence an analyst needs to classify it, and a view limited to the 1,224 alert rows would have escalated it.