Network Platform Analytics

Network Platform Analytics (NPA) clients allow you to monitor and sort through the traffic on the devices in their network. NPA clients can monitor and collect a wide variety of details about network traffic, including app and process identifiers, IP address and port information, and the amount of data sent and received.

Configuring and applying Network Platform Analytics policies with Knox Service Plugin is a two step process:

1. Create an NPA Data Points profile — Configure the network traffic details you want your NPA client to collect.

2. Set Network Platform Analytics policies — These policies govern how the NPA Data Points profile configured previously is used, including which NPA client to use and vendor-specific configuration.

Create an NPA Data Points profile

Under NPA Data Points profile (Premium) create a new configuration, or modify an existing one. Then, configure the following fields:

• Profile name — Specify a unique name for this NPA Data Points profile. This name is used to identify the profile when you set your Network Platform Analytics policies.

  • Select all Data Points — Set to True to automatically collect all the data points listed below. Set to False if you want to select specific data points to collect.

  • Identification number of the application — Collect the identification number of the app from where the network flow originated.

  • Identification number of the process — Collect the identification number of the process from where the network flow originated.

  • Identification number of the parent application — Collect the identification number of the parent to the app from where the network flow originated.

  • Identification number of the parent process — Collect the identification number of the parent to the process from where the network flow originated.

  • Identification number of the app DNS request — Collect the identification number of the app that made the DNS request.

  • IP address of the host — Collect the IP address of the host which originated the network flow.

  • IP address of the receiving host — Collect the IP address of the host that is receiving the network flow.

  • Source port number — Collect the source port number from where the network flow originated.

  • Destination port number — Collect the destination port number that is receiving the network flow.

  • Fully Qualified Domain Name (FQDN) of the destination IP address — Collect the FQDN of the destination IP address.

  • Transport layer protocol — Collect the transport layer protocol used by the network flow.

  • Name of the process — Collect the name of the process from where the network flow originated.

  • Name of the parent of the process — Collect the name of the parent of the process from where the network flow originated.

  • SHA 256 encryption hash of the application — Collect the SHA 256 encryption hash of the app from where the network flow originated.

  • SHA 256 encryption hash of the parent of the application — Collect the SHA 256 encryption hash of the parent of the app which originated the network flow.

  • Number of L4 bytes sent — Collect the number of L4 bytes (network flow payload size) sent during the network flow.

  • Number of L4 bytes received — Collect the number of L4 bytes (network flow payload size) received during the network flow.

  • Network interface — Collect the network interface (such as wlan0, tun0, or rmnet0) which originated the network flow.

  • Start time — Collect the start time of the network flow.

  • End time — Collect the end time of the network flow.

Set Network Platform Analytics policies

Now that you have created an NPA Data Points profile, set policies that govern how it’s used. For company-owned devices, go to Device-wide policies > Network Platform Analytics (NPA) (Premium). For personal devices with a work profile, go to Work profile policies > Network Platform Analytics (NPA) (Premium). Set Enable NPA Controls to True, then configure the following policies:

• NPA Client — Select the NPA client that collects network activity data on the device. Currently, only Cisco AnyConnect is available.

• NPA Profile for Data Points — Enter the name of the NPA Data Points profile you created earlier. This name must match the Profile name value you set previously.

• NPA Vendor Config — Enter a JSON string containing vendor configuration data for your NPA client. This field is required for the Cisco Secure Client Network Visibility Module to receive its configuration parameters. The JSON structure varies by vendor but typically includes the following:

  {
    "NETWORK_ANALYTICS_PARAMETERS": {
      "profile_attribute": {
        "profile_name": "<profile_name>",
        "package_name": "com.cisco.anyconnect.vpn.android.avf",
        "package_signature": "<app_signature>",
        "flags": 65535
      },
      "vendor": {
        "config": "<base64_encoded_nvm_profile>"
      }
    }
  }
  

  NPA Vendor Config requires Knox 3.12 or later and Android 15 or later.

  Contact your Cisco Secure Client representative to obtain the base64-encoded NVM profile for your deployment.