1. Visibility, ability to provide deep insight into all of the network traffic.
2. Analytic engines, the ability to use multiple detection engines like ML-based, Zeek, Suricata, etc.
3. Scale, ability to address policy requirements for N/S and E/W deployments on-prem or in the cloud along with scaleable retention (weeks/months) for PCAP or network metadata.
4. Any and all NTA solutions need to be able to ingest threat intel and be able to integrate easily into SOAR and SIEM solutions.
Network Traffic Analysis (NTA) is critical for identifying and addressing potential security threats by monitoring and analyzing network flows. It provides valuable insights into network health and vulnerabilities, allowing IT professionals to act proactively.NTA tools help organizations protect their assets by closely examining the data traversing their networks. These solutions offer deep visibility into network activities and can efficiently detect anomalies and suspicious behavior...
1. Visibility, ability to provide deep insight into all of the network traffic.
2. Analytic engines, the ability to use multiple detection engines like ML-based, Zeek, Suricata, etc.
3. Scale, ability to address policy requirements for N/S and E/W deployments on-prem or in the cloud along with scaleable retention (weeks/months) for PCAP or network metadata.
4. Any and all NTA solutions need to be able to ingest threat intel and be able to integrate easily into SOAR and SIEM solutions.
5. It needs to fit with budget!
Thanks @Nicholas Arraje this is really useful.