Open Source Security: Fast and Simple

Endace Applied Watch Command Center

The Applied Watch Command Center (AWCC), from Endace, is a powerful and robust security information management (SIM) platform for open source security applications. With an emphasis on providing a comprehensive configuration, control and alarm interface to Snort®, the AWCC has been deployed in government, enterprise and carrier market segments, complementing the world’s leading open source intrusion detection and prevention system (IDS/IPS). Comprising of three distributed components - Agent, Server and Dashboard – the AWCC solution is both scalable and resilient, providing a SIM solution for all network infrastructures from the smallest to the largest – least vulnerable to the most.

Cost Effective Security Infrastructure

A flexible, cross-platform, intrusion management system, AWCC delivers organizations the key to unlocking Snort’s powerful rules-based engine within all network environments. As large security budgets are giving way to smaller security engineering teams - with an overriding demand for increase productivity and lower costs - the Applied Watch Command Center, together with the world’s leading open source IDS/IPS, can dramatically reduce both the capital and operational expenses typically associated with building and managing security infrastructures.

The New Sim For Open Source

With AWCC, all organizations are afforded an ‘enterprise-grade’ wrapper around the powerful open source security tools which have, to date, been driven primarily through command line and scripts. With this front-end face-lift, network architects can create an entire security infrastructure built on open source security applications and services, including honeypots, intrusion detection systems, intrusion prevention systems, vulnerability scanners, port scanners, antivirus scanners, firewalls, and system event logs. The Applied Watch Command Center unites these tools within a single, intuitive, user interface that eliminates the complexities out of command-line management. Unlike traditional SIM solutions, AWCC presents an operational management framework to the underlying applications, granting full command and control to the administrator to supervise operator access policies.

Advanced Ruleset Management

Through the AWCC Dashboard - an unparalleled Java user interface - security analysts are provided a graphical policy manager for creating and administering IDS rules and signatures within disparate Snort sensors. Unique to the AWCC, a download wizard gives security experts the power to review and verify all rules - before they are sent to remote sensors. This policy management system offers a simplified interface when downloading these rules, thereby ensuring their soundness before they are applied to production sensors.

Highest Encryption Standards

Designed for highly sensitive government environments, the Applied Watch Command Center offers the most powerful and secure NIST standard encryption cipher currently available. All traffic, flowing between remote Agents, the Server, and Dashboard components is encrypted using AES-256 bit tunnels.

Packet Review

Providing a key tool for validating false positives, the entire packet dump from an individual attack is provided to the end user, offering a visual display of the packet data that triggered the alert.

Users And Groups

User privileges, unique to AWCC, enable administrators to assign Dashboard operators into groups, thereby preventing events from IDS sensors from being seen, if they do not belong to that subscriber’s management domain. This role-based access separation is ideal for large security deployments in multi-departmental / multi-national organizations, where the administrator may want to specify what Snort sensors individual Dashboard users should have access to.

Vulnerability Management

User privileges, unique to AWCC, enable administrators to assign Dashboard operators into groups, thereby preventing events from IDS sensors from being seen, if they do not belong to that subscriber’s management domain. This role-based access separation is ideal for large security deployments in multi-departmental / multi-national organizations, where the administrator may want to specify what Snort sensors individual Dashboard users should have access to.

Delivering a robust open source security information management interface - putting powerful detection, investigation and response capabilities at your fingertips - the Applied Watch Command Center solution, from Endace, is an indispensable addition to any standard Snort deployment.