largest cyberprobe implementations?

[RYAN-dot-LOCAL]

I think this project is very interesting and appreciate the great documentation. Do you know if this is deployed on 100+, 1000+ node networks and what specs are required to handle the traffic volume?

[cybermaggedon]

Thanks!

Cyberprobe is deployed on hundreds, don't know about thousands of nodes. It does support a scalable deployment model...

• The cyberprobe part of the solution can be deployed across a large set of resources e.g. one per VM on AWS, so that cyberprobes scale up with the VMs you are monitoring.
• Then cybermon can be deployed behind a cloud load-balancer e.g. AWS ELB to scale with load.
• Use scaleable stores such as ElasticSearch or Gaffer graph which can horizontally scale.

For massive scale, use Kubernetes (which is how I deploy). Deploy cyberprobe container as a 'sidecar' to the PODs you want to monitor, and then deploy cybermon PODs as a Deployment behind a single service. That way, the cyberprobe parts scale automatically as the thing you're trying to monitor scales, and the cybermon can scale up as the load increases. Use Kubernetes to deploy Gaffer, ElasticSearch etc. for storage. Use Kubernetes to deploy RabbitMQ and your own stream analytics. You can run it all from within Kubernetes.

I've used cybermon to monitor:

• VPN services deployed as Kubernetes containers.
• Honeytrap services, such as SMB services, fake SSH servers, fake web servers... as Kubernetes containers.
• Web servers which I want to protect.