From NetWitness Platform 12.4 version or later, NetWitness introduces the SASE Integration Plugin from the ConfigureIcon.png Configure > Policies > Content Library page. These plugins can be deployed on the services (Decoders) through a policy configuration, enabling them to capture all the network traffic from various SASE vendors and process the data efficiently, leading to increased network visibility. NetWitness uses the processed data to detect anomalies and displays them to analysts for further investigation and threat-hunting purposes.

SASE_Integration_Plugin_12.4.png

The following are the supported SASE Integration Plugins:

• Palo Alto Prisma Integration

• Broadcom ETM Integration

You must create a policy with the SASE Integration Plugin type and associate the policy with the group having a Decoder service, and then publish the policy. Additionally, you must set up the SASE Integration Plugin details in the Configuration tab for a particular SASE Vendor inside the Policy Details view and save the configuration.

For more information on configuring Palo Alto Prisma Integration, see Palo Alto Prisma SASE Configuration Guide.

For more information on configuring Broadcom ETM Integration, see Broadcom ETM SASE Configuration Guide.

IMPORTANT: Ensure that you always publish the policy after adding the SASE Integration Plugin to deploy the plugin to the Decoder service.

Note:
• When you are adding the SASE Integration Plugin type, always enable the subscription by clicking the subscribed toggle. Once the content is subscribed, the updates are pushed automatically.
• You can also view the SASE Integration Plugin inside a Policy Details page and perform operations like Filter, Enable, Disable, Subscribe, and Unsubscribe those plugin types. For more information, see Manage Policies.

For more information on adding the SASE Integration Plugin content to a policy, see Create and Publish Policies.

For more information on groups, see Manage Groups.

View SASE Integration Plugin Details

This topic describes the steps to view the SASE Integration Plugin details.

To view the SASE Integration Plugin details

  1. Go to (CONFIGURE) > Policies.

  2. In the policies panel, click Content.

  3. In the left panel, click Content Library.

  4. Click SASE Integration Plugin

    The list of SASE Integration Plugins is displayed.

  5. Click a row to view details about the selected SASE Integration Plugin in the right panel.

    The various details of the SASE Integration Plugin are displayed.

    Palo_Alto_example.png

                    

                                                           Previous Page                                                      Next Page