How does bluedog MDR work?
Bluedog inspects all of your network traffic, correlating events, with a broad set of known threats and suspicious behaviour. These events are analysed by our professional security operating centre and reported to you.
How long does bluedog take to start working and begin monitoring my network?
As soon as you plug in the probe and network traffic is routed through it, it will start working and monitor your network.
What are the configuration requirements for bluedog?
It depends on your network. We provide an intake questionnaire when we start working together, which provides us with relevant information for configuration. It will need an outbound internet connection at minimum.
Does bluedog work across all networks?
It will work on the network segments that you will give it access to. In some cases, a monitor port is used so that bluedog's probe will receive all network traffic.
Where should I install the probe?
Usually it is placed in a secure environment near the core switch, with outbound connectivity.
Are any tools required to help me manage bluedog?
No tools are required and therefore no additional/hidden cost. Everything is managed by bluedog; you just plug-in and protect!
How are software updates managed?
bluedog manages all software updates as part of the monthly subscription and reporting fee.
How are the probe upgrades managed?
This is all taken care of by bluedog.
Can I monitor multiple installations?
If your account is set up this way, you certainly can. Usually multiple installations are in use by resellers and will be done in a stand alone monitor environment so that you will be able to access all attached data.
What happens when an anomaly/potential threat is detected?
Our first line SOC analysts will detect the anomaly and will analyse it. When they find the issue to be relevant enough they will scale up a second line SOC engineer for validation and consultation. Once the threat is confirmed the SOC manager is contacted, at which point, all information is presented to the customer or our partner in order to make an informed decision about next steps. Either bluedog can take remedial action, or sometimes that's handled by our reseller partner if such resources are available.
How are threats managed?
- Investigation (avoid false positives)
- Identification (of breach/threat)
- Real incident alert to customer/administrator (email address on file)
- Work order for threat response and action by bluedog
- Action taken to isolate and remove threat.
How are you able to remove the threat?
Approved network access is given via a work order, at which point bluedog will access and remove the threat through the established VPN connection.