LiveFlow security insights - User Guide - LiveWire - 26.2.0

LiveFlow configuration - capture options

The configuration options for LiveFlow Alerts have been upgraded to support more complicated options.

Malicious IP or Domain Detected LiveFlow Alert is one such example. In the LiveFlow capture options, configuration for LiveFlow alerts can be found by clicking the Configure button under the LiveFlow Alerts section, which will display the LiveFlow Alerts Configuration modal.

In the LiveFlow Alerts Configuration modal, the LiveFlow Alerts with more complex options will have a gear icon on the far right which, upon clicking it, will open up a sidebar with more configuration options.

Security insights licensing

Starting in LiveWire 25.3, you must have the Security Insights Enabled LiveWire License applied to the LiveWire to enable the following LiveFlow Alerts:

• Anomalous IP Hops
• Cleartext Credentials Detected
• Encryption on IANA Reserved Port
• Kerberos Detected
• Kerberos RC4 Detected
• Malicious IP or Domain Detected
• Microsoft IP Detected
• NTLM Protocol Detected
• RDP on Non-Standard Port
• Threat Intel Indicator
• TLS Certificate Anomalies Detected
• TLS Client Excessive Handshakes
• TLS Long Lived Connection
• TLS Missing SNI
• TLS Self-Signed Certificate
• TLS Unusual Certificate
• TLS Weak Cipher Suite
• Unassigned Encryption
• Unauthorized Application Use
• Unexpected Encryption
• Unexpected Plaintext

This is not an additional license that gets added or activated, but rather a LiveWire license that includes Security Insights as a feature.

Sending LiveFlow alerts to LiveNX using OpenTelemetry

1. Load LiveNX in your browser.
2. Go to the LiveNX Settings.
   
   
3. Navigate to Network Intelligence Configuration > Network Configuration
   
   
4. Click the LiveAction Receiver Configuration toggle button into the Enabled state to turn on the Network Intelligence feature.
   
   
5. Copy the Token field under the LiveAction Receiver Configuration section. This token will be used to configure OpenTelemetry in LiveWire.
   
   
6. Click the Save button under the LiveAction Receiver Configuration section.
7. Navigate to Security Dashboard and click the Enable Security Dashboard checkbox.
   
   
8. Click the Apply button.

1. Load LiveWire in your browser.
2. Go to the Configure Engine view.
   
   
3. Navigate down to the OpenTelemetry section and perform the following:
   1. Enter customer ID(this part is optional).
   2. Enter the Endpoint of your LiveNX instance. For example: https://livenx.liveaction.com:4317.
   3. Enter the Token from LiveNX. You can find it by clicking Settings, then Network Intelligence Configuration, and Network Configuration.
   4. Check the Use TLS checkbox to configure the OTel collector to use TLS in communication. If you do not check the Use TLS checkbox, no other TLS fields will be displayed. The other TLS fields will only be displayed if you check the Use TLS checkbox.
   5. Select Use TLS to enable TLS support for the OTel collector. If you check the Skip certificate verification checkbox, the TLS certificate fields will not be displayed. The TLS certificate fields will only be displayed if you have not checked the Skip certificate verification checkbox.
   6. Drag/drop the certificate file (*.pem) into the drag/drop region or click Open Certificate File button to upload a certificate file to the appropriate TLS certificate field. To remove an existing certificate file, click the appropriate Delete Certificate File button, a confirmation prompt will appear before deleting.
   7. Click the Apply button in the bottom right corner to apply the specified OpenTelemetry settings to the OTel configuration file and restart the collector service.
   8. Apply the OpenTelemetry settings to multiple engines by clicking the Apply to Other Engines button.
   
   
   
4. Click the Apply button to apply the changes.