LogRhythm NetMon

To detect and respond to cyberthreats quickly, your team needs to actively monitor where threats are likely to first appear—your network.

LogRhythm NetMon provides the visibility and security analytics your team needs to monitor your organization’s entire network—either as an independent network forensics solution or as a component of the LogRhythm Threat Lifecycle Management platform.

Detect even the most sophisticated threats across a broad set of IT environment-generated log and audit data, endpoint activity, and Layer 7 application flow
Recognize data exfiltration, spear phishing, botnet beaconing, inappropriate network usage, lateral movement, and suspicious file transfers
Corroborate high-risk events at the network or application level with environmental activity from your SIEM

Determine the scope of the incident and understand exactly which systems have been compromised
Generate irrefutable network-based evidence
Reconstruct files transferred across the network to investigate suspicious data exfiltration, malware infiltration, and unauthorized data access

Try our Freemium version to transform your physical or virtual system into a network forensic sensor.

True Application Identification: Automatically identify over 3,000 applications to expedite network forensics with advanced classification methods and deep packet inspection.
SmartFlow™ Session Classification: Recover Layer 7 application details and packet data for all sessions.
Deep Packet Analytics (DPA): Automate threat detection by correlating against full packet payload and SmartFlow data using out-of-the-box rules and customizable scripts.
Full Packet Capture: See every bit that crosses your network with Layer 2–7 packet capture stored in industry-standard PCAP format.
SmartCapture™: Automatically capture sessions based on application or packet content to preserve the information you need.
Unstructured Search: Drill down to critical packet and flow data with our Elasticsearch backend to streamline your investigation.
File Reconstruction: Reconstruct email file attachments to support malware analysis and data loss monitoring.
Alerts & Dashboards: Surface continuous, automated analysis on saved searches through customizable analyst dashboards.
API Integration: Provide third-party tools access to session-based packet captures and reconstructed files.

Highly scalable 10 Gbps appliances: Appliances that can keep up as the demands of your network grow
Software appliances for remote sites: A cost-effective and flexible solution for monitoring low-bandwidth remote sites starting at 10 Mbps
Integrate with existing monitoring infrastructure: Whether via span port, tap, or network packet broker, our passive sensors easily integrate with your infrastructure or SIEM
Virtual sensor: A virtual sensor for virtual switches improves your visibility into your cloud infrastructure

Monitoring your network can mean detecting a threat early in the Cyber Attack Lifecycle. And detecting a threat early is the key to protecting your organization for large-scale impact.

To learn more about how network monitoring plays a role in optimizing your team’s Threat Lifecycle Management workflow, read the below white paper.

Learn how your team can reduce time to detect and respond to cyberthreats with the LogRhythm Threat Lifecycle Management Platform.

Detect Advanced Network Threats

Take the Guesswork out of Incident Response

Get Started for Free

Network Visibility with Powerful Features

Flexible Deployment for Network Monitoring

Prevent Cyber Incidents as Part of the Complete Threat Lifecycle Management Workflow

See LogRhythm in Action