Search

The Explore > Search view allows users to search the Plixer Scrutinizer host index to quickly verify whether or not a host has been seen on the network.

Searches can be performed for either individual hosts or pairs (host to host). Simultaneous lookups for multiple hosts or pairs are also supported.

Important

To be able to search for hosts and host pairs, the corresponding indexing feature must be enabled.

• Traffic direction (inbound, outbound, A > B, B < A, bidirectional)

• First and last seen timestamps

• Exporter/source of collected data

• Bytes in and out

• Packets in and out

• Flows in and out

Hint

To show fewer details in search results, click the the table button and untick the checkboxes for the columns to be hidden.

In the search results, drilling into a host will display a summary of its activity on the network. Clicking on a data source opens a tray that allows the user to quickly pivot to any supported report type.

Enabling host indexing

When host indexing is enabled, Plixer Scrutinizer will store records for all hosts that pass traffic on the network. Records for host pairs can also be stored (and searched through) by enabling host to host indexing as indicated below.

To enable host indexing:

1. Navigate to Admin > Alarm Monitor > Flow Analytics Configuration.

2. Open the configuration tray for the Host Indexing algorithm.

3. Add sources/inclusions for the algorithm either indvidually or using Security Groups.

   Hint

   Recommended inclusions for host indexing are internal/core routers, edge routers, and public IP addresses that have been assigned to IP Groups.

4. If there are sources (IP addresses/ranges, domains (by reverse DNS), IP Groups, etc.) that should not be indexed, add them as exclusions.

5. Expand the Settings secondary tray to configure the following:

   • Days of Host Index Data Retention

   • Host Index Database

   • Host Indexing Domain Socket

   • Host Index Max Disk Space

   • Host Index Sync Interval Minutes

   • Host to Host Database

   • Window Limit

   Important

   Entering a database path in the Host to Host Database field enables host pair indexing. To disable the feature, leave it blank.

6. Use the toggle to enable the algorithm and close the tray.

Once the algorithm has been configured and enabled, users can use the Explore > Search view to search the host or host pair (if enabled) index.

Hint

If the Use Host Index option (Admin > Settings > Reporting) is enabled, only Exporters that a host has been seen on will be searched when data is aggregated for a report. This can significantly reduce the time it takes to run reports.

Resource requirements

When enabling host and/or host to host indexing, it may become necessary to allot additional CPU cores and RAM to the Plixer Scrutinizer deployment.

Furthermore, the host to host index will include records for two types of host pairs:

• Continuously active pairs, whose records will not expire

• Ephemeral unique pairs, whose records expire but are replaced at approximately the same rate

To ensure enough storage is available for the host pair database, it is highly recommended to expand the disk space allocated to Plixer Scrutinizer.

Disk space calculation

To approximate the amount of additional disk space needed, start by using a report to calculate the number of host pairs:

1. Create/run a new a Host to Host pair report and add all Exporters that were defined as inclusions for the Host Indexing FA algorithm.

2. Set the time window to cover a period of at least 24 hours.

3. When the output of the report is displayed, click the gear button to open the Options tray and select Global.

4. In the secondary tray, select the 5m option from the Data Source dropdown and click Apply before returning to the main view.

5. Note the total result count, which will be roughly equivalent to the number of active pairs.

6. Return to the Options > Global tray and switch to the 1m data source option.

7. Subtract the previous result count from the updated total result count to determine the number of ephemeral pairs.

After obtaining the active pair and ephemeral pair counts, the following formula can be used to calculate additional disk space requirements for host to host indexing:

(Active pair count + Ephemeral pair count) * Exporter count * 200 B

where Exporter count corresponds to the total number of Exporters/inclusions defined for the Host Indexing algorithm.

Utilization alerts

If the combined disk space used by the host and host pair databases reaches 100% of the Host Index Max Disk Space setting of the Host Indexing algorithm, host and host to host indexing will be suspended until storage becomes available again.

The following Alarm Policies are used to alert users to high disk utilization by host indexing:

Host Index Disk Space Warning	Triggered when the disk space used by host indexing functions reaches/exceeds 75% of the specified Host Index Max Disk Space
Host Index Disk Space Error	Triggered when host indexing functions are suspended because the Host Index Max Disk Space has been reached
Host Index Disk Availability Error	Triggered when host indexing functions are suspended because disk utilization for the volume the host and host pair databases are stored on has reached/exceeded 90%

Host indexing functions will automatically restart once sufficient storage is available, either due to record expiry or because disk space has been added.