Definitions#
The Admin > Definitions page contains management views for the various user-defined elements and groupings used by the Scrutinizer system.
Applications Defined#
The Definitions > Applications Defined page lists all configured application definitions. Each entry shows the application name and a summary of the associated rules.
This feature is used to label in-house applications for accurate traffic classification. Some applications use multiple IP addresses, port ranges, and protocols. The Applications feature allows you to group these values under a single application definition.
Clicking the three-dot menu next to the application name opens a dropdown menu to View Rules or View Ports. This opens the definition tray where the settings, rules, and ports can be modified.
Defining a new application#
Click the add (+) button to open the configuration tray.
In the Settings field, enter the name/label for the application. This label is used throughout Scrutinizer to identify traffic associated with the application.
Click Save to open the Add Rule secondary tray.
Select a rule type from the dropdown menu, enter the required details, and then click Add.
Rule types#
When adding a rule in step 4, select one of the following rule types based on how you want to match network traffic.
All IP Addresses: Matches traffic from any IP address. Use this option when no IP-based filtering is required.
All Ports and Protocols: Matches traffic on all ports and all protocols.
IP Address: Matches traffic to or from a single, specific IP address.
IP Range: Matches traffic within a defined range of IP addresses.
IP Subnet: Matches traffic within a subnet defined using CIDR notation.
Wildcard Mask: Matches traffic using a wildcard mask to define flexible IP address patterns.
Port Number: Matches traffic on a specific port and protocol.
Each defined application must include at least one port rule and at least one IP rule. Both components are required to properly classify network traffic. If you attempt to save an application without one of these rule types, an error message is displayed prompting you to add the missing rule.
Note
When importing application definitions using the scrut_util import utility, each rule is processed individually per line. Valid rules are imported on a best-effort basis, even if they do not form a complete application definition. After importing, review each application in the UI to confirm that it includes both port and IP rules to ensure accurate traffic classification.
Bulk actions#
When one or more applications are selected using the checkboxes, the following batch operations become available via the Bulk Actions button:
Adding new rules to all selected applications
Deleting all selected applications
Autonomous Systems (AS)#
The Definitions > Autonomous Systems (AS) page lists all defined autonomous systems along with their autonomous system numbers (ASN) and any provided descriptions.
Clicking on an AS name opens an activity summary view with the following visualized information (split into source and destination tabs):
Activity over time
Top applications
Top source hosts
Top destination hosts
Hint
The period of time covered by the summary (default: last 15 minutes) can be adjusted by clicking the time range (calendar) button.
Clicking the graph button/shortcut in the top application or host charts will run the corresponding report type with the appropriate filters applied.
Host Names#
The Definitions > Host Names page can be used to assign static names to non-expiring host IP addresses or create subnet labels for use in reports.
The main view lists the following details for all current name definitions:
Host name
Domain
IP address
Description (if provided)
DNS resolution status (see below)
Clicking on a host name opens the settings tray, where the name, domain, description or DNS status can be edited.
Defining a new host name assignment#
Click the add (+) button to open the configuration tray.
Configure the following details:
IP address
Name to assign
Domain
Description (optional)
Select one of the following DNS resolution statuses from the dropdown:
Current: Resolution or resolution attempt completed, and the name will expire as specified by the retention setting under Admin > Settings > DNS
Queued: Ready for resolution; can be set to force DNS resolution again
Never: DNS resolution will never be attempted, and the name will not expire; used for assignments that are manually added and should be permanent
Click Save.
After the host name has been saved, it will be added to the list in the main view and can be further modified at any time.
Note
Host name definitions can also be imported using the scrut_util import command.
Deleting host names#
To delete a host name definition, select one or more items using the checkboxes in the main view, and then use the Delete option in the Bulk Actions menu.
IP Groups#
The Definitions > IP Groups page can be used to create and manage IP group definitions, which can be leveraged when running reports, applying filters, or defining inclusions/exclusions for various functions.
The main view lists the following details for all IP groups currently defined:
Group type/locality (internal or external)
Group name
Child groups
Inclusion rules
Clicking on a group name opens the settings tray, where the group’s name, type, and rules can be edited. If the group is or includes child groups, its hierarchy tree can also be viewed in this tray.
Defining a new IP group#
Click the add (+) button to open the Add IP Group configuration tray.
Enter a name for the group.
Select whether the group is internal or external from the IP Group Type dropdown.
Click Save.
In the main view, click the newly created IP group to open the configuration tray.
Expand the Rules section of the tray, and then click the (+) button to add a new rule.
In the secondary tray, select the rule type (IP address, subnet, etc.) to add.
Enter the details required for the rule in the additional fields.
Click Add to save the rule.
Repeat steps 6 - 9 to define additional membership rules for the group. Settings for existing IP groups can be further modified at any time.
Note
IP group definitions can also be imported using the scrut_util import command.
If there are overlapping host sets between IP groups, a host will automatically be assigned to the group whose rules define the narrowest range of addresses.
The locality (internal or external) of an IP group has multiple uses, including determining traffic directionality (e.g., internal->internal, external->internal, etc.) for FA detections and defining inclusion and exclusion filters for report data sources. The designation also allows addresses to be quickly identified as being internal or external when viewing host details.
Bulk actions#
When one or more IP groups are selected using the checkboxes, the following batch operations become available via the Bulk Actions button:
Adding new rules to all selected IP groups
Deleting all selected IP groups
MAC Addresses#
MAC (Media Access Control) addresses are unique hardware identifiers assigned to network interfaces. Scrutinizer collects MAC address information automatically from Cisco wireless LAN controllers via SNMP and from flow data containing option templates with stamacaddress and username elements. The collection process is scheduled to run nightly.
The Definitions > MAC Addresses page can be used to manually add or edit MAC address definitions for easier identification in reports and monitoring.
Defining a new MAC Address#
Click the add (+) button to open the configuration tray.
Enter the MAC address (e.g., 00:1A:2B:3C:4D:5E).
Enter a label or description for the MAC address.
Click Save.
The newly added MAC address appears immediately in the main view. Clicking a defined MAC address opens the configuration tray where only the label/description can be edited.
Deleting MAC Addresses#
To delete a MAC address definition, select one or more items using the checkboxes in the main view, and then use the Delete option in the Bulk Actions menu.
SNMP Credentials#
The Definitions > SNMP Credentials page can be used to add/manage sets of SNMP credentials for use with devices/exporters in the Scrutinizer environment.
Once defined/saved, credentials can be assigned to one or more specified exporters from the exporters management view. SNMP v1, v2, and v3 are all supported.
Defining a new SNMP credential#
Click the add (+) button to open the configuration tray.
Fill in the form with the following information:
A name to identify the credential(s) by
A description of the credential(s)
The SNMP credential type/version (dropdown)
The community string to send
The port to use for communication
The timeout value or number of minutes to wait for a response
The number retries after a failed request
The backoff value or number of minutes to wait between retries
Note
If SNMPv3 is selected as the credential type, the additional fields for the username, context, and authentication details (hash method, password, and encryption type) must also be filled in.
The non-C AES encryption options are the standard RFC-compliant Blumenthal implementations. Credentials for Cisco devices should be set to use AES192C or AES256C.
Verify that the information entered is accurate, and then click Save.
Saved credentials can also be edited at any time by clicking on their name in the main view table.
Deleting SNMP Credentials#
To delete an SNMP credential, select one or more items using the checkboxes in the main view, and then use the Delete option in the Bulk Actions menu.
Type of Service#
Type of Service (ToS) and Differentiated Services Code Point (DSCP) are numeric values in IP packet headers that indicate traffic priority. The Definitions > Type of Service page can be used to add custom labels for these values to make reports easier to read.
Important
The ToS Family must first be set under {ref}:Admin > Settings > Reporting <a-settings-reports>.
Clicking the three-dot menu icon or clicking directly on the ToS label opens the configuration tray where the ToS Label can be modified.
Well-Known Ports#
The Definitions > Well-Known Ports page can be used to create and manage well-known port definitions for Scrutinizer.
The main view lists the following details for all current definitions:
Name assigned to the well-known port
Port
IP protocol
Description (if provided)
Clicking on a well-known port name opens the settings tray, where the name or optional description can be edited.
Defining a new well-known port#
Click the add (+) button to open the configuration tray.
Configure the following details for the well-known port:
Name
Port
IP protocol
Description (optional)
Click Save to save the definition.
After the well-known port definition has been saved, it will be added to the list in the main view and can be further modified at any time.
Deleting well-known ports#
To delete a well-known port definition, select one or more items using the checkboxes in the main view, and then use the Delete option in the Bulk Actions menu.