SRAN NetApprove

Known and Unknown Device Reporting: Allows for the classification of devices as known (approved) or unknown. Once the values are confirmed, any unauthorized devices entering the network can be detected (Rogue Detection).
BYOD (Bring Your Own Device) Reporting: Displays values for portable devices accessing the organization’s computer network, differentiating between desktops (e.g., laptops) and mobile devices. It also identifies who has brought portable devices into the organization’s network.
Device Inventory Reporting: Records device values including device names, user names from Active Directory, values from Radius Authentication, user IP addresses, MAC addresses, departments, and device brands and models.
Software Inventory Reporting: Records software values, categorizing the software types used such as web browsers, multimedia software, office software, and inappropriate software like Bittorrent and crypto mining programs.

Ability to Detect System Attack Behaviors: This includes detecting brute force password attacks on critical devices and servers.
Malware/Computer Virus Detection: Capable of detecting malware or viruses within the network without requiring software installation on client machines.
Ransomware Behavior Detection: Ability to detect ransomware behaviors that could potentially affect the organization.
Detection of Communication-Camouflaging Software (Tor/Proxy): Able to identify software that conceals communications to evade detection within the computer network.
Cyber Threat Intelligence System: This system collects data from external sources to monitor threats from an outside-in perspective, comparing against blacklisted IPs/Domains and hash values associated with attacks targeting the organization’s systems. It also tracks connections from organizational computers to external Command and Control (C&C) servers.

Capable of analyzing and inspecting protocols used by Web Applications, DNS, DHCP, Active Directory, Mail, VoIP, and File Sharing
Able to analyze and inspect authentication-related protocols such as NTLM, Radius, and Kerberos.
Capable of analyzing and inspecting remote access communications, including RDP and VNC.
Able to analyze and inspect VPN-related protocols such as SSH, OpenVPN, and WireGuard.
Able to analyze and inspect file-sharing protocols within an organization, such as SMB, FTP, and WebDAV.
Capable of analyzing protocols used in OT (Operational Technology) systems, including Modbus, DNP3, BACNET, S7comm, and COTP.

Protocol and Service Monitoring: The system can calculate bandwidth usage on the network by separating protocols (TCP, UDP, ICMP) and services according to well-known port services, allowing for detailed tracking and accurate assessment of data usage.
Application Monitoring: Provides reports on application usage and data consumption within the organization.
Social Network Monitoring: Tracks the usage of social networks like Facebook, Line, YouTube, Google Video, Twitter, and Pantip, providing insights into data usage within the organization, helping management understand the activity and data consumption.
User Monitoring: Reports and ranks bandwidth usage within the organization, showing user names and identifying those with the highest bandwidth consumption for detailed reporting.

Search Categorization: Search by protocol types such as Web Access, Files Access, Network Connection, SSL, Mail, Database, Syslog, VoIP, Remote Desktop, Radius, and Active Directory, with the ability to search raw logs for both current and historical data up to 90 days.
Efficient Search Capabilities: Quick searches using conditions like AND, OR, NOT for efficient querying.
Reporting: Generate reports based on search results, with customizable formats like Line, Bar, Pie, Doughnut, Polar Area, and exportable in CSV, Excel, or PDF.

Log Recording: Captures computer traffic data, ensuring data accuracy and security during storage.
Support for Various Log Types: Logs from Active Directory, Router/Firewall/VPN, Mail Servers (Exchange, Lotus Notes), DHCP, DNS, SNMP, Radius Wi-Fi Controllers, and more, with automatic categorization Industrial Protocol Support: Compatible with protocols used in modern SCADA systems, such as DNP3 and Modbus.
Data Export for Evidence: Capable of exporting data for evidence gathering.
Integrity Hashing: Ensures data accuracy using Integrity Hashing.
Legal Compliance: Log storage complies with legal requirements, supported by SRAN Module Logger, certified by NECTEC standard NTS 4003.1-2560.

Active Directory Login Monitoring: Tracks login successes and failures.
SSH Login Monitoring: Tracks SSH login successes and failures.
Files Audit: Monitors file modifications, renames, openings, and deletions without requiring additional software.
Login Audit: Monitors login attempts, generating reports on user login activities.

Risk Analysis: Analyzes and categorizes network threat events by high, medium, and low risk levels.
Risk Assessment Reporting: Generates risk assessment scores and grades (A-F), providing a comprehensive overview of organizational threats.
Continuous Risk Assessment: Uses passive vulnerability assessment techniques with historical risk assessment review capability.
High-Risk Alerting: Configurable alerts for high-risk levels, with notifications via Line.

Enhanced Log Recording: SRAN NetApprove is equipped to store legal network logs and syslogs, capable of handling both Network logs and Syslogs.
Hardened Appliance: The appliance has hardened firmware to close vulnerabilities, capable of logging events from various devices, such as firewalls, network devices, operating systems, and databases, while maintaining uniform formatting.
Data Encryption: Data encryption using SHA-256 to ensure log data integrity.
Comprehensive Log Support: Logs from devices like routers, switches, firewalls, VPNs, and servers.
Secure Management: Device management through HTTPS, Command Line Interface, and SSH, with Role-Based Access Control.
Legal Compliance: Ensures accurate log file storage according to computer-related crime laws, certified by the National Electronics and Computer Technology Center (NECTEC).
Data Backup: Supports data backup to external storage devices like tape, DVD, or external storage.