Network Detection Models are always-running search conditions applied to incoming flow. Alerts are then generated when thresholds are exceeded.

System

The System tab consists of the following columns:

Checked/Unchecked: This column allows you to select one or multiple Detection Models to apply changes to them simultaneously.

Recommended: This thumbs up column provides three options to choose from: All, Recommended, or Default. The Recommended option displays Detection Models that are most appropriate for your environment.

Name/Desc: This column displays the name and description of each Detection Model. To learn more about the detection model, click its name to be redirected to the Netography help documents. A new page will open and display the detection model and details related to it.

Categories: This drop-down provides 28 categories to choose from, including all categories and 26 specific categories. Selecting a category filters the Detection Models by the chosen category.

NQL Search: This search field allows you to filter for Detection Models using Netography Query Language (NQL).

Thresholds: This drop-down provides three options to choose from: All, Medium, and High. Selecting a threshold filters the Detection Models by the chosen threshold level.

Track: This field displays the Detection Models that are actively tracking.

Enabled: This drop-down provides three options to choose from: All, Enabled, or Disabled. Selecting an option filters the Detection Models by their enabled status.

At the far left of each row, there is an ellipsis icon that allows you to edit the settings and audit log entries of each Detection Model(DM). Open a copy of the target model, allowing you to configure a new DM based on the settings of the existing one. Netography Fusion enables you to tailor Detection Models to the specific needs of your environment.

Custom

The Custom Detection Models portal screen has the same columns as the System tab minus the recommendation columns:

Checked/Unchecked: This column allows you to select one or multiple Detection Models to apply changes to them simultaneously.

Name/Desc: This column displays the name and description of each custom Detection Model.

Categories: This drop-down provides 28 categories to choose from, including all categories and 26 specific categories. Selecting a category filters the custom Detection Models by the chosen category.

NQL Search: This search field allows you to search for custom Detection Models using Netography Query Language (NQL).

Thresholds: This drop-down provides three options to choose from: All, Medium, and High. Selecting a threshold filters the custom Detection Models by the chosen threshold level.

Track: This field displays the custom Detection Models that are actively tracking.

Enabled: This drop-down provides three options to choose from: All, Enabled, or Disabled. Selecting an option filters the custom Detection Models by their enabled status.

The Custom Detection Models portal screen is specifically for custom-defined/configured Detection Models, allowing Detection Model creation tailored to environments.