In this video, you and I get a chat with the logic and concept regarding
administrative
domains on the 40 analyzer. And the acronym for that is an ADOM, administrative
domain.
Now, why in the world would we want to have an ADOM and what does it do for us?
Let's imagine we
have a building and let's imagine that building has let's say four floors. So
for one, two, three,
and four. And I know in some parts of the world, you know, the first floor is
like the ground floor,
then the first floor starts here or whatever. But for this purpose, I'm going
to go ahead and
just say this is floor number one, floor number two, floor number three, and a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just say this is floor number one, floor number two, floor number three, and a
floor number four.
And let's also imagine we have some security guards that are responsible for
the various floors.
So let's say we have security guard A and security guard B. And then
furthermore, let's imagine that
we have security guard A to be responsible for floors three and four. And we
want security guard B
to be responsible for floors two and one like that. So how would we control
that? Well, one option
is we simply give security guard A the keys to three and four. And we have
security guard B,
the keys to one and two, and then put them in charge of those respective floors WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the keys to one and two, and then put them in charge of those respective floors
. Well, on the
40 days, we have something similar to that. Also, we have virtual domains where
we could
carve up a firewall into multiple virtual domains and then give different
administrators access
and responsibility for those individual virtual domains. Or we could give
access, for example,
to one group of administrators, we could give access to these three firewalls
if they're not
split up into virtual domains, just to manage all three of them. Think of that
like team A,
as far as the administrative team, and then for the branch firewall over here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as far as the administrative team, and then for the branch firewall over here,
maybe we're giving
that to a different team and we'll call that team B. So the logic is the same.
We're segmenting
the control management, for example, these floors and obviously firewalls to
individual teams or
individual people or groups. So the next logical piece is if all of these
devices, for example,
the firewall one, firewall two and firewall three are all setting their logs
over to the 40 analyzer
and branch firewall one is also saying it's logs or the 40 analyzer. We
probably want to put similar
people in charge of being able to work with and use those logs in that
information. So on the 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information. So on the 40
analyzer, though, we carve that out and give certain groups access to that
reporting and that
information is by creating on the 40 analyzer logical administrative domains.
And then when we
bring the firewalls in, for example, these three, we assign them to, for
example, one
administrative domain, where these administrators have access to that and can
do reports and look
at logs and do threat hunting and so forth. And then we have this firewall over
here said is logging
information to a different administrative domain and then give the
administrators here access to
that administrative domain. And that's how we can keep it sorted out. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that administrative domain. And that's how we can keep it sorted out. So
regarding ADOMs,
here's how it works. When we set up the 40 analyzer, the first thing we're
going to need to do is to
enable administrative domains, we can start carving it out and having different
devices report
and send their logs to different administrative domains. And the first one we
're going to have
is the root ADOM. And that's actually the literal name of it called root ADOM.
And then it happens
when you enable ADOMs on the 40 analyzer. And so perhaps we have these three
firewalls we're going
to put in the root ADOM. And then for our next ADOM, maybe we call it for the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to put in the root ADOM. And then for our next ADOM, maybe we call it for the
branch firewall here.
Perhaps we name it BR1 for branch number one dash ADOM or something similar. So
that way when we see
it, we'll realize what it's for. Then this firewall here, we can add that and
have it report to this
40 analyzer to the specific administrative domain called BR1 ADOM. We also have
the ability to delete
administrative domains. But before we do that, we'd have to remove any firew
alls that are reporting
in or say their logs to that administrative domain before deleting it. And we
can also move
devices to different ADOMs. Let's say we create a new ADOM called new ADOM, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
devices to different ADOMs. Let's say we create a new ADOM called new ADOM,
just for grins here.
And let's imagine that we have these firewall one that's running for a year.
And it's reporting to
the root ADOM. And then after a year, we move it and we move it instead of
going to the root ADOM,
it starts forwarding its logs to the new ADOM. Now by default, all those logs
that it's been
sending for the year are still going to be found for historical purposes in the
root ADOM. And then
any new logs would then be sent to the new ADOM. So here's what I propose to do
in the next video.
Let's go ahead and we'll enable ADOM support at the 40 analyzer. And then we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go ahead and we'll enable ADOM support at the 40 analyzer. And then we'll
go ahead and
create a new ADOM. And then we'll start moving some of the firewalls around
into the different
administrative domains. So I'll see you in the next video as we start working
with administrative
domains on the 40 analyzer.