Security Infrastructure Automation Platform Overview - BlueCat Infrastructure Assurance - 25.2.0

BlueCat LiveAssurance User Guide

ft:locale
en-US
Product name
BlueCat Infrastructure Assurance
Version
25.2.0

Turn Key Solution Architecture

BlueCat LiveAssurance (formerly known as Infrastructure Assurance and originally Indeni), henceforth referred to as LiveAssurance in this guide, uses the LiveAssurance Automation platform that is comprised of many components including LiveAssurance Server, LiveAssurance Insight (henceforth referred to as Insight in this guide), LiveAssurance Automation Elements and the LiveAssurance Collector. Let’s take a closer look at the LiveAssurance Server which includes the Collector, Software, and User Interface.

LiveAssurance Server

  • Collector – The Collector is a fairly lightweight component whose sole purpose is to interact with network and security devices, issue commands and API calls and collect data. The scripts the Collector runs are written in Indeni Knowledge Language (IKL). The data collected by the Collector is comprised of small atomic units called “metrics”. Some “metrics” can be pretty large, containing whole sets of configuration data collected from devices.
  • Server – The Server is where the data processing actually occurs. There is only one Server in each environment and with it are installed multiple types of databases, all of them on the same virtual or physical machine. The Server instructs the Collector which devices to connect to, what credentials to use, what commands to issue, and it receives the output from the Collector. The metrics received from the Collector are stored in special databases, depending on the type of metric.

    The Server contains the Rule Engine, which runs analysis scripts written in IKL on top of the metric data collected from devices. The scripts can generate issues for the user to action. Additionally, the Server uses machine learning capabilities to automatically detect anomalies and contains a CVE engine to retrieve vulnerability information. See the Infrasturcture 8.4 blog for more information.

    Lastly, the Server makes all of its data available through APIs, to be consumed by external components such as the Dashboard.

  • User Interface – The LiveAssurance Server user interface that is used to change settings, add devices and view the issues generated by the system. Every action possible through the user interface and every data point presented, are all available through the Server’s APIs.

See Understanding the Basics for more information.

LiveAssurance Insight

Insight is a continuously updated database that provides the global network and security community with the data to understand how devices behave in the real world. By democratizing this data, LiveAssurance enables engineers and architects to make better decisions, and write better code.

See LiveAssurance Insight for more information.

LiveAssurance Automation Elements

The full set of scripts developed and approved by community members are called “Automation Elements”. The Automation library is open and fully accessible. You can view the issues and actionable remediation steps here, and also the code here.

See LiveAssurance Knowledge for more information.

Automation Elements contain two types of automation: Auto-Detect Elements and Auto-Triage Elements. Auto-Detect Elements evaluates metrics collected by the collector and raises an alert. Auto-Triage Elements automatically execute additional commands to identify the root cause of the problem. See 3.5 Auto-Triage for more information.