When evaluating Network Traffic Analysis, what aspect do you think is the most important to look for?

Modern Security Operations teams have access to vast amounts of data, but this has not translated into greater effectiveness. The goal of NTA is to not only eliminate blind spots with unprecedented visibility, but to also cut through the noise of alerts with high-fidelity behavioral analytics.

In addition, it should dramatically reduces the time required to take action, from days to seconds, through automated investigations. To achieve these goals, NTA takes advantage of new machine learning and network traffic analytics technology. At its core, NTA which should be powered by an open, programmable, and extensible real-time streaming analytics platform and cloud-based behavioral analytics for full layer-7 visibility.

• NTA shave Analytics and Investigation platform for the enterprise.


• NTA real-time analytics and machine learning to every network transaction to cut through the noise and deliver concrete answers


• Much like SIEM, NTA turned logs into operational insights, NTA turns network data into real-time situational intelligence


• NTA technology is often used by Security and IT Ops teams to support key initiatives like Security, App Service Delivery, and IT Modernization

It depends what your environment is. We have very good experiences with two solutions. When you're using Cisco Networking, their Stealthwatch solution (also part of their EA, a full NBA/ADS* solution) does a very good job and gets more and more integrated in their Networking, Security and Admission Control solutions. When you are looking for a less expensive solution, we have very good experiences with Flowmon, a spin off from the University of Brno (Tsjech Republic) and a very mature NBA/ADS* solution as well. In NL Flowmon is successfully in use by education, healthcare, finance and transportation.
*NBA/ADS: Network Behavior Analysis / Anomaly Detection System.

Network Performance, bandwidth utilisation, data flow speed, Bottlenecks, nodes issues, network medium issues, segmentation efficiency, distributed network requirement as a solution, multicast required as a solution or re design it.