Security Insights Blueprint

This blueprint demonstrates how Security Insights can be integrated into customer-premises equipment (CPE), branded routers, gateways, and other network appliances. By combining Netify Deep Packet Inspection (DPI) with Network Intelligence, Security Insights transforms complex network telemetry into clear, actionable cybersecurity indicators that can be presented through a simple customer-facing dashboard - either on-device or in the cloud (see adjacent example).

Cybersecurity Subscription Opportunities

By integrating the Netify Network Intelligence plugin, vendors can quickly add differentiated cybersecurity services without building and maintaining complex network inspection and analytics pipelines.

Security Insights provides a foundation for subscription tiers such as Advanced Security or Premium Protection. Vendors can turn network intelligence into an ongoing managed service that delivers tangible value to customers while creating a new source of recurring revenue.

Because Netify uses modern, lightweight detection and intelligence techniques, these capabilities can run efficiently even on modest CPE hardware.

Netify Security Insights dashboard showing cybersecurity risk indicators

Complementary to IDS/IPS

Traditional intrusion detection/prevention systems (IDS/IPS) are powerful but can be complex to deploy, operate, and interpret. Security Insights is complementary rather than a replacement for IDS/IPS. It focuses on high-level risk indicators, behavioral anomalies, and policy violations that are easy for customers and network administrators to understand and act upon. Rather than overwhelming users with individual packets, signatures, and events, Security Insights answers the more practical question:

Is there anything happening on my network that I should be concerned about?

Example Security Insights

VPN and Tor usage: Detect encrypted tunnels, proxy services, and dark web traffic entering or leaving the network.
DNS tunneling: Identify devices exfiltrating data or issuing commands hidden inside DNS queries.
DNS port evasion: Flag DNS queries sent over non-standard ports in an attempt to bypass local resolvers and content filters.
Encryption anomalies: Surface weak encryption, expired certificates, or suspicious TLS handshakes.
Network risk indicators: Combine DPI, intelligence, and behavioral heuristics to identify cybersecurity risk.
Policy violations: Identify network behaviors that conflict with configured security or acceptable-use policies.

Requirements

To implement the Security Insights Blueprint, include the following components:

Install and configure the Netify Agent
Install and configure the Network Intelligence Plugin
Install and configure a Sink Plugin for the telemetry
User interface integration

Configuration

Intelligence Plugin

The Network Intelligence Plugin documentation includes a demonstration configuration to help you get started quickly. In production, the optimal combination of enabled indicators, scoring thresholds, and update cadence depends on your hardware profile, network environment, subscriber base, and the specific security insights you want to deliver.

Netify can help you tune the engine for your environment and identify the right balance between coverage, performance, and actionable results. Contact us to discuss your requirements.

Asynchronous Telemetry

DPI application detection occurs within the first few packets of a flow. Network intelligence analysis can happen just as quickly, but some indicators require additional traffic or state before they can be confirmed. The engine continuously tracks flow state and performs additional analysis as traffic evolves.

Intelligence events can be correlated with previously detected flows using the digest, allowing downstream systems to associate security insights with the underlying application, device, and network activity.

Each detected event is reported in the flow's intel array using a consistent schema containing a category, indicator, and confidence score. The adjacent JSON example shows a vpn_application_consumer event, but the same structure is used for other Security Insights, including DNS tunneling, DNS port evasion, and TLS/certificate anomalies.

This consistent telemetry model makes it straightforward for downstream dashboards, analytics platforms, and policy engines to consume and act on security indicators without requiring a separate integration for each type of insight.

"flow": {
  ...
  "digest": "c4c07ca55baa19",
  "local_ip": "192.168.88.115",
  "local_mac": "c2:54:46:ae:90:ab",
  "local_port": 44370,
  "other_ip": "103.108.94.162",
  "other_mac": "44:39:c4:8f:0d:92",
  "other_port": 6464,
  "intel": [
    {
      "category": "vpn_detection",
      "data_feed": "vpn_application_consumer",
      "event": "dpi_complete",
      "indicator": "vpn_application_consumer",
      "indicator_driver": "vpn_application_consumer",
      "score": 70
    }
  ]
  ...

Available Sink Plugins

Once generated, intelligence telemetry needs a delivery path off the device. The Netify Agent's Sink plugins handle that final step:

Log: Local filesystem.
HTTP: HTTP/S to an API endpoint.
MQTT: Message queue servers.
Socket: File sockets, TCP sockets, or WebSockets.
ubus: OpenWrt ubus.
Custom: Custom sink plugin.

Conclusion

Security Insights offers a clear opportunity to help customers see and act on what happens on their networks. Combine the Netify Agent's protocol and application intelligence with your portal to deliver advanced network insights in days rather than months.