March 25, 2025

This release introduces new capabilities and usability improvements, including: 🎯 Traffic Top Presets for faster investigations ⏱️ User Inactivity Timeout configuration 🔎 Prominent Table Filter Indicators for visibility and ease of use 📐 New threshold functions (averagein(), countin()) for high-latency ingestion detection 👥 Roles Page now displays inline permission summaries and supports column filtering 📝 Event Details Page refinements for layout and interaction improvements

🎯 Traffic Top Enhancements

Traffic Top has been improved to make it easier to use and more valuable for investigation.

• bits is now an available column

• Traffic is now sorted by Count (descending) by default

• Aggregate by now has a search bar at the top

Traffic Top Presets

There are a new set of buttons at the top of the Traffic Top page that provide preset configurations for common ways you can leverage Traffic Top for investigations.

Traffic Top Preset Buttons

Traffic Top > Investigate Hosts Configuration

⏱️ User Inactivity Timeout

There is a new configuration option for setting a User Inactivity Timeout on the Settings > User Management > Global Security/SSO page. This allows administrators to define how long a logged-in user can be idle before they are automatically logged out of the Fusion Portal. This is Disabled by default, to avoid changing the behavior for existing users.

User Inactivity Timeout Configuration in Settings > User Management > Global Security/SSO

🔎 Table filters are now prominently displayed

If you have ever added a filter to a column in Fusion, and then later gone back to that table and wondered why isn't all the data showing up only to realize it was because you had applied a filter, this feature is for you.

Filters applied to a table (by hovering over a column name and then selecting the filter icon that appears), are now displayed directly above the table, where they can be viewed and removed.

Example of multiple filters applied to a table

In addition, a number of small design improvements have been made to tables, including the ability to select for copy/paste labels shown in column cells.

🧾 Flow Details Page redesigned with contextual insights and shortcuts

The new Flow Details page now shows the IP Summary table that was added in last month's release to the updated Event Details page. This includes more information about the source and destination IPs for the flow record directly on the page. It also includes buttons to get more directly to the most common next steps in investigating a flow.

The flow details page, as well as the event details page, now contain a back button at the top-left corner to close the Fusion tab and return to the table the details page was opened from.

Flow Details

IP Summary Action Buttons

The IP Summary table in the Event Details and Flow Details page contains 6 clickable Action buttons on each row. These buttons were added to give you 1-click access to the most common actions. Previously, you would click the IP to bring up a property tray on the right-hand side of the Fusion Portal, and then select these actions from the bottom of that tray.

Clickable buttons in IP Summary Table

Hover over a button to see the tooltip describing it. The actions, from left to right, are:

• Search Flow

• Traffic Top

• IP Events History

• IP Intelligence

• IP Explorer

• Add IP to Discard List

📐 New averagein() and countin() threshold functions for Detection Models to handle high-latency ingest sources

When setting a threshold in a Detection Model, two new functions:

averagein(window,metric)

countin(window,metric)

These functions complement the maxin(window,metric) function that was added in last month's release.

These functions perform a windowed aggregation of the given metric with a duration of seconds in the first argument. For instance:

countin(30, bits) > 10000

Translates to: "if any period of 30 seconds across the entire rollup window has a total count of bits for all records that exceeds 10000."

This is designed to allow traffic sources that may have late data ingest (eg latency in receiving flow logs or DNS resolver logs from a cloud provider) to have a rollup window that is long enough to account for the delay (up to 20 minutes) while not requiring aggregations for triggering that would hide “spikes” of data necessary for some detections. For example, if there is an acceptable baseline of failed queries, but a large number of failures in a short period of time is indicative of an attack.

While these threshold functions will be primarily used by Netography's Detection Engineering to build more robust and accurate detection models, it is available directly to use in your own detection models as well. If you need more guidance or assistance leveraging this new function, contact Netography Support.

Threshold averagein() function in Detection Model Configuration

👥 Updated Roles Page

The Roles page at Settings > Roles has an updated design to allow you to see a summary of permissions for each role. To see the full permissions for the role, click the ⋯ button next to the role and select Edit.

The summary of permissions in the table will show a green check if ALL permissions in that section are selected. It will have a gray check if ANY permission in that section is selected. You can choose a more granular specific permission to display in this table by adding a table filter. Hover over the column name and then click the filter icon that appears, and then choose the specific permission you want to filter by from the drop-down list.

Settings > Roles with No Filters Applied

Settings > Roles with filter to show Roles with permission to create dashboards

Event Details Page Refinements

The Event Details Page that was redesigned in last month's release has had some further refinements based on user feedback. This includes moving the Detection Model summary to be more prominent, improving the ability to resize columns in the IP Summary table, and other small changes.