User's Guide

Reports
60 of 218
Healthcare Dashboard
The Healthcare Dashboard displays applications used in the healthcare
environment including patient care, medical applications, and HIPAA.
Venue Dashboard
The Venue Dashboard displays data grouped according to sports, social media,
news and weather applications, as well as software update applications.
IP Reputation Dashboard
This report displays potential threat activity on your network from IPaddresses
known to be suspicious. IP addresses can be flagged as suspicious for a variety
of reasons, including forced IPanonymity through the use of a Tor exit node,
being listed as a threat by the Emerging Threats project, or classified as
suspicious by internet users. Additionally, each IPaddress classification has its
own recommended course of action, listed below.
l CiArmy Top Attackers — The CiArmy reputation feed is a set of IP addresses tied to
malicious activity defined by a collaborative network security effort backed by the
Emerging Threats project. Any IP communications to addresses in this list from the
local network are suspicious and may indicate that the local IP is involved in various
activities such as command and control communications with the remote host. IP
addresses classified as CiArmy Top Attackers require further investigation.
l Compromised Hosts Connecting Into the Network — IPaddresses that match this
classification are on a list of IP addresses maintained by the Emerging Threats
project. This list consists of a set of IP addresses that appear to have been
compromised by malware, individual actors, worms, botnets, or other means. When
ExtremeAnalytics detects application flows that match an IP from the Compromised
list, this is a likely indicator that systems in the local network are either under attack
or have already been compromised (since the communications may be command
and control directives emanating from the compromised host).
l Connections to Bad Hosts — IP addresses classified as Connections to Bad Hosts are
known to function as command and control nodes for various botnets around the
Internet. Any flows to or from such IP addresses have a high probability of being
associated with botnet command and control traffic.
l Connections to Bad Hosts Based on Port — IP addresses flagged in this classification
are known to function as command and control nodes for botnets based on the port