- Find: Starting with passive monitoring of network traffic, datafusion is able to identify, classify and store information of all network transactions.
- Store: The from the complete network traffic is indexed and stored in a database.
- Enrich: This metadata is enriched with user information via user databases like Active Directory, LDAP, Radius and geolocation information. Log files from web and mail servers additional value.
- Analyse: The c the analysis of the data. The user creates and refines search actions by various criteria which results in pin-pointed information.
- Visualize: The generated information is displayed in a rich GUI in different formats like heat maps of traffic for a specific traffic generation, traffic over a time period or filtered on specified user traffic.
- Identify: Via various combinations of filters an infected computer can be identified or a specific attack detected.
- Act: Appropriate actions the infected computer out of service or specific firewall rules to deny malicious traffic.