Date: 04/16/2025
Vendor: NetQuest
Technology/Topic: Streaming Network Sensor (SNS) Technology
______________________________________________
Welcome to the Technical Exchange Meeting (TEM)!
Traditional mechanisms for generating valuable metadata for threat hunting teams have utilized some version of “sampling” because the tools available were not capable of metering every packet on 100G links. For true security threat hunting, these mechanisms will no longer provide the required level of visibility to detect modern cyber threats.
NetQuest offers what we call “Unsampled Flow Metadata Data Generation” and 100% network visibility that scales with your network from a single 10G link to 16x100G in a single 1U appliance.
With NetQuest, your security team will gain the following capabilities:
— Flow Generation exports standards-based 1:1 unsampled (or sampled) IPFIX flow data, scaling from a single 10G link to multiple 100G links.
— Add metadata to make the entire data stream ready for AI/ML analysis
— Intelligent flow metadata distribution ensures the correct team gets the right information at the right time.
— Advanced Packet Processing performs mass header/tunnel removal and passes targeted packet flows, in addition to IPFIX flow data.
— Application Classifier provides real-time contextual information by identifying protocols, user applications, and extracting additional application-specific attributes. The advanced DPI-based classification engine recognizes over 3,800 applications including classification of encrypted and evasive traffic.
— Network Security includes metadata fields beyond standard NetFlow including DNS information, SIP call info, OSPF/BGP routing messages and information from TLS/QUIC handshakes including JA4/JA3/HAASH fingerprints.
______________________________________________
To join the DISA TEM mailing list, please contact: disa.tem@mail.mil
______________________________________________
Disclaimer:
— TEMs do not serve as a marketing venue or request for proposal actions.
— TEMs shall not be interpreted as a commitment by the Government to issue a solicitation or ultimately award a contract.
— TEMs do not serve as an endorsement of any presented technologies or capabilities
— Presentations will not be considered as proposals nor will any awards be made as a result of a TEM session.
— TEMs are public open forums – no proprietary or sensitive information should be presented during TEM sessions. Only publicly facing content is permissible in DISA TEM sessions.