{"id":4145,"date":"2019-02-20T11:35:12","date_gmt":"2019-02-20T10:35:12","guid":{"rendered":"http:\/\/nextron.bsk-consulting.de\/?p=4145"},"modified":"2022-03-25T14:15:01","modified_gmt":"2022-03-25T13:15:01","slug":"remarks-on-products-and-services","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/","title":{"rendered":"Remarks on Products and Services"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”3.22″][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”3.27.4″]<\/p>\n

We constantly improve the quality of our products and services, add features and create new bundles. Follow ups with our customers showed that not all of these changes reach their attention. They are often surprised and excited to hear about these features, free tools or license bundles. This is a list of the changes that often go unnoticed.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” column_structure=”1_3,2_3″][et_pb_column type=”1_3″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”3.27.4″]<\/p>\n

1. Scanner licenses allow you to run THOR and SPARK<\/h1>\n

Customers who have bought scanner licenses to scan Servers and Workstations, be it an Enterprise or Host-based license, can use both our scanners THOR and SPARK. If you have bought an Enterprise license for THOR in the past, you are also allowed to download and use this license with SPARK on Linux or macOS endpoints. Download SPARK from the “Downloads” section in the customer portal.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”2_3″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/02\/Screenshot-2019-02-16-at-10.19.39.png” align_tablet=”center” align_last_edited=”on|desktop” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.4.2″ hover_enabled=”0″]<\/p>\n

2. SPARK applies Sigma rules on endpoints<\/h1>\n

Customers are often surprised to hear that. We have customers that are not allowed to collect logs on endpoints due to legal restrictions but they are able to start executables like our scanner SPARK on endpoints, which is able to apply Sigma rules on local Eventlogs. This way, they can apply detection rules on systems that they do not actively monitor. The blog post –\u00a0SPARK uses Sigma Rules in Eventlog Scan<\/a> has more information on that feature.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.4.2″ hover_enabled=”0″]<\/p>\n

3. Some contracts include a free ASGARD Management Center and Analysis Cockpit<\/h1>\n

Enterprise customers with a valid support contract for our scanners are eligible for a free ASGARD Management Center<\/a>, which is able to control and schedule scans on up to 10.000 end points and an Analysis Cockpit<\/a>, that allows you to ingest and analyze the logs of up to 50.000 end points in a comfortable manner.<\/p>\n

Customers with more than 10.000 licensed endpoints are eligible for additional ASGARD Management Centers and a MASTER ASGARD, which is the central management for multiple ASGARD systems.\u00a0<\/p>\n

See the Video Tutorials<\/a> page to learn how these systems can help you with you daily management and analysis tasks. If you are interested in these systems and your account status, please contact your account manager.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” column_structure=”1_3,2_3″][et_pb_column type=”1_3″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”3.27.4″]<\/p>\n

4. YARA signature overview in Customer Portal<\/h1>\n

The customer portal contains a CSV with information on all 9973 YARA rules in our signature set (as of 16.02.2019). This way you can verify if a certain threat group or campaign is covered by our rules or not. You can find that CSV in the “Software Information” section together with binary hashes and an update server status on all our products.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”2_3″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/02\/Screenshot-2019-02-16-at-10.53.15.png” align_tablet=”center” align_last_edited=”on|desktop” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/02\/Screenshot-2019-02-16-at-10.54.48.png” align_tablet=”center” align_last_edited=”on|desktop” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” column_structure=”1_3,2_3″][et_pb_column type=”1_3″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”3.27.4″]<\/p>\n

5. Kibana can be installed together with ASGARD Analysis Cockpit<\/h1>\n

We do not support this coexistence but prepared everything to make it easier for you to install Kibana next to our own interface to analyze the collected log data. The analysis cockpit manual has a chapter that explains how to install Kibana on an Analysis Cockpit. The Analysis Cockpit wraps Kibana and serves access as reverse proxy providing a common authentication. You can manage the service from within the “Settings” section of the Analysis Cockpit.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”2_3″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/02\/Screenshot-2019-02-13-at-14.46.30.png” show_in_lightbox=”on” align_tablet=”center” align_last_edited=”on|desktop” _builder_version=”4.4.2″ max_width=”35%” hover_enabled=”0″][\/et_pb_image][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/02\/Screenshot-2019-02-13-at-14.53.19.png” align_tablet=”center” align_last_edited=”on|desktop” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”3.27.4″]<\/p>\n

Feedback<\/h1>\n

If you have any feedback, questions on these features, please let us know.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

We constantly improve the quality of our products and services, add features and create new bundles. Follow ups with our customers showed that not all of these changes reach their attention. They are often surprised and excited to hear about these features, free tools or license bundles. This is a list of the changes that often go unnoticed. 1. Scanner licenses allow you to run THOR and SPARK Customers who have bought scanner licenses to scan Servers and Workstations, be it an Enterprise or Host-based license, can use both our scanners THOR and SPARK. If you have bought an Enterprise license for THOR in the past, you are also allowed to download and use this license with SPARK on Linux or macOS endpoints. Download SPARK from the “Downloads” section in the customer portal. 2. SPARK applies Sigma rules on endpoints Customers are often surprised to hear that. We have customers that are not allowed to collect logs on endpoints due to legal restrictions but they are able to start executables like our scanner SPARK on endpoints, which is able to apply Sigma rules on local Eventlogs. This way, they can apply detection rules on systems that they do not actively […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"

We constantly improve the quality of our products and services, add features and create new bundles. Follow ups with our customers showed that not all of these changes reach their attention. They are often surprised and excited to hear about these features, free tools or license bundles.<\/p>

This is a list of the changes that often go unnoticed:<\/p>

1. Scanner licenses allow you to run THOR and SPARK<\/h1>

Customers who have bought scanner licenses to scan Servers and Workstations, be it an Enterprise or Host-based license, can use both our scanners THOR and SPARK. If you have bought an Enterprise license for THOR in the past, you are also allowed to download and use this license with SPARK on Linux or macOS endpoints. Download SPARK from the \"Downloads\" section in the customer portal.<\/p>

\"\"<\/a><\/p>

2. SPARK applies Sigma rules on endpoints<\/h1>

Customers are often surprised to hear that. We have customers that are not allowed to collect logs on endpoints due to legal restrictions but they are able to start executables like our scanner SPARK on endpoints, which is able to apply Sigma rules on local Eventlogs. This way, they can apply detection rules on systems that they do not actively monitor.<\/p>

The blog post -\u00a0SPARK uses Sigma Rules in Eventlog Scan<\/a> has more information on that feature.<\/p>

3. Some contracts include a free ASGARD Management Center and Analysis Cockpit<\/h1>

Enterprise customers with a significant number of licensed endpoints are eligible for a free ASGARD Management Center, which is able to control and schedule scans on up to 10.000 end points and an Analysis Cockpit, that allows you to ingest and analyze the logs of up to 50.000 end points in a comfortable manner.<\/p>

See the Video Tutorials<\/a> page to learn how these systems can help you with you daily management and analysis tasks.<\/p>

If you are interested in these systems and your account status, please contact your account manager.<\/p>

4. YARA signature overview in Customer Portal<\/h1>

The customer portal contains a CSV with information on all 9973 YARA rules in our signature set (as of 16.02.2019). This way you can verify if a certain threat group or campaign is covered by our rules or not.<\/p>

You can find that CSV in the \"Software Information\" section together with binary hashes and an update server status on all our products.<\/p>

\"\"<\/a><\/p>

The CSV looks like this:<\/p>

\"\"<\/a><\/p>

5. Kibana can be installed together with ASGARD Analysis Cockpit<\/h1>

We do not support this coexistence but prepared everything to make it easier for you to install Kibana next to our own interface to analyze the collected log data. The analysis cockpit manual has a chapter that explains how to install Kibana on an Analysis Cockpit.<\/p>

The Analysis Cockpit wraps Kibana and serves access as reverse proxy providing a common authentication.<\/p>

\"\"<\/a><\/p>

You can manage the service from within the \"Settings\" section of the Analysis Cockpit:<\/p>

\"\"<\/a><\/p>

The indexed log data looks like this:<\/p>

\"\"<\/a><\/p>

Feedback<\/h1>

If you have any feedback, questions on these features, please let us know.<\/p>","_et_gb_content_width":"","footnotes":""},"categories":[46,71],"tags":[188,191,79,187,147,186,190,192,189,62,78,59,64,48],"class_list":["post-4145","post","type-post","status-publish","format-standard","hentry","category-newsletter","category-partner","tag-changes","tag-customer","tag-feature","tag-features","tag-licenses","tag-nextron","tag-overview","tag-portal","tag-reminder","tag-rules","tag-scanning","tag-sigma","tag-spark","tag-yara"],"yoast_head":"\nRemarks on Products and Services - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"Remarks on Products and Services\",\"datePublished\":\"2019-02-20T10:35:12+00:00\",\"dateModified\":\"2022-03-25T13:15:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/\"},\"wordCount\":1009,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"keywords\":[\"changes\",\"customer\",\"feature\",\"features\",\"licenses\",\"nextron\",\"overview\",\"portal\",\"reminder\",\"Rules\",\"scanning\",\"Sigma\",\"spark\",\"YARA\"],\"articleSection\":[\"Newsletter\",\"Partner\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/\",\"name\":\"Remarks on Products and Services - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2019-02-20T10:35:12+00:00\",\"dateModified\":\"2022-03-25T13:15:01+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Remarks on Products and Services - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"Remarks on Products and Services","datePublished":"2019-02-20T10:35:12+00:00","dateModified":"2022-03-25T13:15:01+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/"},"wordCount":1009,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"keywords":["changes","customer","feature","features","licenses","nextron","overview","portal","reminder","Rules","scanning","Sigma","spark","YARA"],"articleSection":["Newsletter","Partner"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/","url":"https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/","name":"Remarks on Products and Services - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2019-02-20T10:35:12+00:00","dateModified":"2022-03-25T13:15:01+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2019\/02\/20\/remarks-on-products-and-services\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/4145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=4145"}],"version-history":[{"count":11,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/4145\/revisions"}],"predecessor-version":[{"id":7247,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/4145\/revisions\/7247"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=4145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=4145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=4145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}