Name: Armis Centrix™ v25.0 Product Release Webinar
Uploaded: 2025-01-21T17:14:55.919Z
Duration: 34 min 48 s
Description: Armis Centrix™ v25.0 Product Release Webinar

Transcript for "Armis Centrix™ v25.0 Product Release Webinar": Good morning, good afternoon, good evening, depending on where you are. Welcome to this webinar where we'll be highlighting the Armys 25 dot o release. I'm here with Rich Stutes this morning. How are you, Rich? Doing amazing. Thanks for having me. Fantastic. We'll give it another minute so that people can join, and then we'll get this, webinar starting. Thanks again for joining us today. We'll give it one more minute, as people are still entering the Goldcast webinar, and then we'll kick things off. First time we use Goldcast. So we used to run Zoom webinars, so this looks more professional. Guess that we're all grown up. Looking great. So people are still figuring out how to use it maybe. Different experience, but we'll get there. So, I see people are still joining. So if you allow me maybe 30 seconds to 1 minute more so we have a a good starting point with our audience. And hello to Aaron. I see your chat message. Good to see you on the on the webinar. Okay. So before we start the the presentation part of this webinar, some logistics because we are using a new platform, Goldcast instead of Zoom webinar. Normally, we would have had, Grace Chen hosting this webinar as usual. Unfortunately, she she had a family, emergency, so she won't be here today. It's just Rich and myself doing the presentation as we used to run these webinars for some time. And I'm also really pleased to have Daniel, on the q and a. Daniel is from our PM team, at Armis. So if you have any questions, product related questions during the webinar, please, make sure hi, Daniel. Make sure to to post them using the q and a functionality. That will be easier so that we can address these questions live, and that other attendees can see the responses. So, if we are not able for some reason to provide you with the right answer today, we will definitely follow-up because we're we'll be getting, all this information after the webinar. I'm gonna kick things off, by sharing the screen and showing you the presentation. Just a quick validation, Rich. Can you see everything here? I can see it perfectly fine. Fantastic. So welcome again to this to this webinar. Every quarter, we will, discuss the release highlights. We we will obviously be discussing the release 25 dot o, 1st of the year, in terms of timeline, in terms of how this came all of this came together. We sent out a customer notification. It was just before Christmas, and then we did the initial rollout. This is a gradual rollout over all tenants starting on January 6th. That was the general availability date of the 25.0 release. We do the webinar typically, a bit more than 2 weeks after the start of the rollout, so to make sure that every tenant got the latest version. So by now, this should be the case. So welcome again to this webinar where we'll be guiding you through the highlights and also, more importantly, the business value that these highlight brings bring to you as a customer. These are commercial highlights. These are use case highlights. If you're interested to see a more deep dive version of this webinar, a demo of the features that we will be showing today, Be aware that we'll be hosting a separate session for that. So today is more of a commercial use case session. We'll keep it short and sweet and business outcome focused. If you wanna see demo, you wanna see the bits and bytes on how how to set things up and a more deep dive approach. Next Wednesday, January 29th, we'll have, this session. We'll have it twice. We'll have it in the morning and the afternoon depend depending on when you want to attend. So make sure you register. As I'm speaking here, Rich Vistante will be posting the the registration links directly into the chat. If for some reason you don't, have the ability to register today, you can find all of this information on the Armys community. We'll point you to an Armistice community back at the end of this webinar. Before we go into the latest and the greatest of this release, I should notice or I should, notify you about the fact that a few major features that were previously announced now went, generally available. The reason why I mentioned this is because if you have been attending our webinars in the last months or so, this might become repetitive. Like, this isn't the first time probably you hear about the network segmentation metrics. It's probably also not the first time that you hear about this cyber exposure management dashboard that we built or the ability to use natural language search. However, since we discussed it during previous webinars, I'm not going to bother you again with all of the details. But I think it's worth noting because these are major improvements to the product, major improvements to the platform. So just a single slide per feature as a kind of a gentle reminder of what we built here and what became generally available in the 25 dot o release. Starting with, network segmentation metrics. The GA stands for generally available, as you probably guessed. What is it? It's this visual way to represent any cross boundary communication because we know from experience that network segmentation is an ongoing thing. It's not a one off configuration. Once you have set your network segmentation rules, once everything is in place, this, visual metrics will help you to identify cross boundary communication. Essentially, what you see here on the screen is that every dot, represents a cross boundary communication. If you click on the dots, we will provide you with all of the details. We will tell you, for example, that in this case, there's been a cross boundary communication between the medical network and the corporate network, which is probably something you don't want to see. All of this information is clickable. It will give you a list of affected devices. So it will go also give you, the protocols that have been used. So this is an easy visual way to explore all of this intersegment communication. It can assist you with both the planning, but also with enforcement of network segmentation. And I think more importantly, it can identify gaps in your existing segmentation projects. Many customers ask for these features. It's now generally available in 25 dot o. 2nd feature, major development that became available in this release is the exposure management dashboard. This is an entire new dashboard that is designed to provide you with a comprehensive summary of your attack surface and all possible exposures. You can use it as a seesaw. You can use it as a decision maker to gain immediate insights into how your organization is doing. You can easily drill down to the assets that matter to your business. You can easily filter on sites and boundaries. This is fantastic to track progress and make informed decisions because this is your, one stop shop dashboard, but it's also, actionable data. So for the, operational part or the practitioner part at the on the army's console, All of these, dots, all of these gauge dashlets, all of these lists are clickable so you can take instant action on whatever is being presented in exposure management dashboard. And last but not least, the support for natural language search. We let this run for as an early access feature for quite a long time because we were really interested in your feedback using this was this helpful? Functionality gave us a lot gave a lot of feedback and allowed us to optimize this functionality. So ASQ is now generally available. Sorry. Natural language search is now generally available. An alternative to ASQ, but one doesn't just exclude the other. It's just that it's a better user experience and a better way to query relevant data to all, yeah, for all of our users. And then we come to the other highlights of this release. So, there are a lot of enhancements in this release. There's there's new use cases that we address as I just explained. I'll be covering some of the enhancements, and then, Rachel will be up to you to cover the the reminder. Starting with a small, improvement but important, for your daily, work into the army's console. Do you know that by default, we present you with these, homepage top dashlets? They're literally in your face. It's, the dashlets that show you total devices, the high risk devices, the threat activities, and any unhandled alerts. If you think this is useful for your daily job into the army's console, fantastic. You can keep it. If you think this is annoying and distracting you from the work that you do because this the this this isn't really the the statistics or the the numbers that you are looking for on a daily basis. You can now just hide it. There's a new collapse and expand button. It's set to to expand by default, but now you can as a user, you'll be able to focus on what matter most, to you in your daily use of the Armys platform. SentriX Insights is our umbrella name for a lot of smart features within within the, console. Instead of giving you 4 slides, I have a one and a half minute video, so it's really short. This will give you an overview of everything that we built under the umbrella of Centrix Insights, and then I'll be focusing on a very specific feature, which is a Centrix Insights AI assistant. But first, let's have a look at the short video. Maxime, I don't think we're getting audio for for this video itself. Okay. Well, thanks for notifying me. See, this is part of the learning curve and the glitches that we'll get with this new platform. So instead of trying to fix this, today, I'll just walk you through. It will be easier. We'll make sure that this video gets some airtime on the next, on the next webinar. What I wanted to highlight is that with SentriX Insights, you get a lot of literally insights that we that we group with the billions of assets that we track. And I just highlighted one here, which is the industry benchmarks. This is available on any tenant. If you see this little icon here, on on the right corner top right corner of a dashlet, it means that you can compare how you are doing against your industry peers. For example, you want to have, you're you might be monitoring your end of life operating systems or end of life hardware, and you want to know how similar organizations within your industry are doing. This is what we call the industry benchmark. So in this case, you would be flagged under retail trade because this is how we onboarded you as a customer. And then you would be able to compare how you are doing, for example, in phasing out obsolete software or phasing out obsolete hardware, how you stack up against your your industry peers. So this is a way of for us to give back insights based on of, based off all the meta metadata that we that we gather from all of our customers. The new part in 25 dot o is an improvement in the SentriX AI, SentriX Insights AI assistant. The in AI assistant is something that already exists. It's something that that you can leverage for your daily, queries on the Army SentriX platform to get access to, documentations, queries on how to build dashboards, etcetera. The new part is that it can now suggest, Army standard query or ASQ. So it makes the documentation easy and accessible to engage with, but now it can also, pre, recreate all of the ASQs that you might need for your work in the Army's, platform. And sometimes a picture or a demo says more than a 1000 words. So really easy. If you go to the to the, army's console, you have the SentriX inside the system available here. If you haven't used it, that's where it's located. And once it loads, you can just query it with, in your own language. So I have a question ready made here. Let me share this completely so you have an overview. Can I get a list of devices with an active CrowdStrike agent? Right? Might have been relevant in the last months or so. So SentriX assistant oops. There's the Murphy's Law. I might have to reload it. Maybe it's been opened for too long before I started the demo, so I'm gonna give it another try. Here we go. Generate ASQ. I think I will need to there it is. So this is the new part. It can generate ASQ sites you can see here. And if you click on the ASQ, it will immediately pull up the army's console and provide you with a list, and with the results of this ASQ. So I was asking for overview of a list of all devices that have an active CrowdStrike agent. On this demo tenant, we have 16 devices, and this is based off an ASQ that was generated by the SentriX AI assistant. No need to, study ASQ. You can now just query the AI assistant. So this is a huge improvement that we added in the 25.0 release is that it will now even suggest, ASQ. Another, optimization, if you will, in terms of explainability or another enhancements. This is something that we introduced in previous releases is to expose the raw data that kind of show you how we come to certain decision when it comes to building the the foundation of your asset inventory. We're adding more data sources like the knowledge base or the army's intelligence army's asset intelligence. These are the 5 +1000000000 that we are tracking, but also traffic inspection from the army's collector. So, the more raw data we expose, the better you understand how we come to certain decisions. We also, give you the strength. Like, if we believe this is a strong or a weak signal for us to come to a certain decision, you'll be able to get that information if you hover over the data. Another column that we added is the device name. Just so this is new, functionality. Again, always providing you with more transparency. This is not new. The new part is that we're exposing even more raw data with traffic inspection and knowledge base or the asset intelligence. And all of these enhancements provide you with greater transparency so that you get a detailed view of how, we come to certain decision decisions and how we shape your asset inventory. Another big thing in terms of explainability, and this has been asked by many customers, is the CVE confidence level. You can see EA. That means early access. Mean, it hasn't been enabled by default. This is a functionality that if you want to try it, give it a try, or test it on your tenant, you need to, contact your customer success manager or work with army support to have this enabled on your tenant. And it's very, straightforward. Essentially, what it gives is if you have those CVEs identified, in the console, we'll give you a confidence level to indicate how certain armies is that this vulnerability exists on an asset in your environment. So this is really to get clear explanations for these assigned confidence levels, but more importantly, to eliminate false positives because we know the quality of the data is, paramount for you to make the right decisions. So having, an a notion of confidence level, whether it's confirmed, as you can see here that we saw this, specific vulnerability on on assets in your environment or high confidence, low confidence with, additional context as you hover over these confidence levels will greatly improve your experience, will greatly improve your, the decision making process when it comes to, prioritizing and remediating vulnerabilities and CVEs in this case. Now we have some other highlights. And for this, I will, give the word to to Rich if you're still online. I'm still here. Thanks so much, Maxine. Thank you, Rich. So so I'll focus a little bit more on enhancements surrounding, ASQ protocol group filtering, some enhancements to network mapper stages for really understanding the status of of where your particular device are being mapped to, and then really kinda dive a little bit deeper into some new and enhanced integrations. I can even go to the next slide. So amazing. So we'll start with the ASQ protocol group filter. Now in the past, when you wanted to kinda, you know, filter based off of a specific protocol in IB connections, you'd have to actually select the protocol. Now if you wanted to focus on things like OT or BMS or medical, you had to actually know the exact protocol that you were trying to to get for IP connections, and it was really hard to kinda look at a much wider kinda spans, in terms of, like, the protocol itself. Now with the new enhancement for ASQ protocol group, you could actually select the protocol group itself. So if you wanna focus on OT or BMS, you could take all of the different, protocols that are used inside your environment and group them to see the IP connections themselves. This really makes it much easier to to really build out ASQs where you get increased flexibility. The ease of use is greatly enhanced, and really just being a lot more efficient in how you create ASQs and get the data to what you really need to to do what you need to in terms of, you know, remediation, and mitigation. Next slide, please. The next enhancement is the network mapper, really focusing on stage columns. This adds a lot of more properties to network mapper so you can see things like ARP records, device profile, interfaces to really understand the status of those particular network devices being mapped. Think of this as kind of being like a a troubleshooting and maintaining and and maintenance of, network mapper to see where your devices have been mapped to. Are they partially, mapped, or do you have full network map that kinda going through that? This really enhances the the capabilities itself to network mapper to see which ones have been mapped, which ones haven't. Just provides a great, kind of one stop shop area to understand network mapper itself. Next slide. Yeah. Now we'll focus a little bit more on the new integrations. There's been a ton of new integrations, in 25 dot o, whether that's the endpoint management vendors, like your Fortinet 40 EDR from IGEL for universal management suite, matrix 42 for UEM, BigFix inventory, as well as pulling in asset context from Zimperium MTD. There's also been enhancements to the network. We'll go through a little bit later. And then there's also been a ton of asset management integrations. On the network side, we have a new integration with Checkpoint IoT Protect. In the past, we had integration to send information to Checkpoint itself. With their new product, we've updated the APIs to really support to their existing, capabilities there. We also are getting asset context from Cisco Nexus dashboard insights or NDI as well as Ruba Central. We'll go through it a little bit later. And then on the asset management perspective, we have a ton of integrations for spanning from Acronius Acronis, Synet, FSI for the medical devices, IBM Cloud services, as well as Microsoft. Now all of these integrations, whether they're from or to, enhance what you already have today. Whether it's pulling an asset context into Armis, greatly enhance and correlates from your other data sources. But, also, if you are sending data to something like a Check Point IoT Protect, this increases the value of what Check Point can build policies on for things like network segmentation. So, really, the business value itself is on not just improved visibility, but more actionable insights with your existing tool sets. Next slide, please. And this next slide is all about enhanced integrations where we list the various properties that are available for the individual integrations themselves. For endpoint management, for Dynatrace, we have enhanced, actually pulling in supported software apps. For Microsoft, we have had enhancements for Microsoft Defender for endpoint to import noninteractive users and Macs without IP addresses. This is all a selectable configuration option. For Symantec, SEP, we've integrated with both the cloud or on premises through the collector. And then for Palo Alto Cortex XDR, there's a new config option to actually import the serial number from those agents that are deployed using Cortex XDR. And then lastly, for the endpoint management, there's enhancements to SCCM for additional software and hardware properties. On the network side, we have enhanced integrations with Aruba Central for getting, enhanced asset context for things like network mapper to get more switch port information. For Nanobot, we have added support for their new version 2 for their API as well as a new MAC address for the import option. And then we've also added for on the network side for tenable vulnerability management. The new vulnerability management enhancements include additional properties for lasso can authentication scan and a couple other lasso authentication properties. And then kind of rounding out the asset management capabilities, the software enhancements, For Lansweeper, now enhancements for additional properties includes location and route path. For Microsoft ensure ID, there's been a ton of new properties that are pulled in from the user perspective where you can get additional user properties as well as configure options for ensure ID. And then now with Service Graph, connector, there's a version 2 where it greatly simplifies the seem to be imports, for those that are using ServiceNow to keep your seem to be up to date, pulling in all of the asset context that you get from Armis and keeping that bidirectional communication with ServiceNow itself. Again, whether they're new or enhanced integrations, this is all about improving visibility from both the Armis side, but also your existing tools that you're using for remediation. Next slide. Going a little bit deeper, these are just some of the new capabilities that have been, introduced in 25 dot o. This screenshot is for Microsoft Windows Server Update Services or WSUS, where you could select the server host name, the actual server port, and the database that you wanna pull from inside of WSUS. This new enhancement, this new integration integrates with my Microsoft WSS for important asset context. So if you wanna understand, more bios information, more operating system version numbers and build numbers, if you wanna get more information on the agent itself and the last sync, All this is really important to correlate with all of your other data sources so you can make actionable decisions based off of the information, not just from Microsoft WSYS, but from the hundreds of other tools that you may have inside your organization. Next slide. I mentioned this a little bit, earlier, but there's also been enhancements for both, Aruba Central as well as Cisco NDI. This is really extending network mapper capabilities with Aruba Central. It supports retrieving switchboard information, including VLAN data. There's also switch links invisible inside the network diagram itself. So think of this as an integration that's enhancing what you may be already doing with network mapper, but using your existing tools like Aruba Central and Cisco NDI. This allows you to fetch device data, gathers IP address and MAC address, all really important information, that could be used to really better map what's available inside your network and environment and then correlate that with all of your assets that you have. Next slide, please. Very similar to a Ruby Central, Cisco network dashboard insights are very kinda extending network mapper capabilities to the Armis environment. So taking your asset information, your ARP tables, your MAC tables, and surrounding neighbors, all this is very relevant thinking about not just the assets themselves, but how they're communicating and the neighboring, assets that are that you're actually communicating with. Next slide. I mentioned Checkpoint IoT Protect. We've had integrations with Checkpoint in the past. Now with their new Checkpoint IoT Protect product, we have a new integration here where phase 1 is actually enabling asset enrichments to send asset contacts from RMS to the Checkpoint IoT product, greatly enhancing the your network segmentation, and more network policies, inside a checkpoint itself using the RMS data that you are that you're either getting from your passive network monitoring, your smart interactive query, all of the hundreds of integrations that we pull in as asset context. Greatly simplifies the network segmentation inside the environment itself. Next slide, please. We also, added a new integration for Zscaler for supporting their ZCC or client connector. For organizations that are using the client connector, this is really important to understand if it's being used, how it's being used, and if it's operational. So this could be a very important compliance use case where I if I am in an environment and I'm trying to communicate to my, important, say, SaaS data that's inside my organization and I'm not using ZCC and it's not operational, it's not up to date, this could be a huge, compliance issue for my organization itself. So being able to understand that it's being used, it's being deployed, and the actual device has it is very important for compliance use cases. Next slide, please. And then kind of rounding out, we've also, added support for supporting the ZIA or Zscaler Internet access traffic logs. In the past, we had the integration with the private access, but organizations that are not using SPAN TAP and using ZIA may wanna have a lot more information of how that asset is being, being used. Things like IP connections and how ZIA is being used outside the just your traditional network, can be very important for considerations of which applications that are being accessed from. And 2, and really getting more into, you know, how that device is being communicated, with the outside world. So Zscaler, both from the ZCC, from the client perspective, as well as the traffic logs itself, really just adds and enhances, you know, what you had today with SPAN Tap, but extends that out to your traffic logs to really understand outside just the traditional network itself. And the next slide. So kinda rounding out a little bit for in terms of the digital community. So really, the community at armis.com, this is where you could find all of the release notes for 25 dot o, where you can go into even more detail on the capabilities that we just went through. But in terms of the deep dive, what Maxine went through a little bit earlier, there's 2 deep dives and demos that goes into 25 dot o, both at 8 AM, EST as well as 3 PM EST. So I highly recommend going into the chat itself and registering to go a little bit deeper into the 25 dot o capabilities. And with that, I think we'll open up to q and a and, kinda finish it up. Thank you so much, Rich. Let me see if we have any unanswered questions. I hope, Daniel, it wasn't, an avalanche of questions coming your way. Are we okay? Yeah. I'm just going down the list of the q and a. Yes. Okay. I don't see any open questions unless I might miss them. Do you see any, Rich? No. I see one question on Jira integration from SentriX, not from Viber. Yeah. I don't see any open ones that haven't been answered yet. Okay. So maybe on the Jira integration from SentriX, not Viber, that is something that has been, moving. Right? So we used to have this integration as part of SentriX for, and the older product called AVM. Now we have this as part of Viber. So, I'm not entirely sure if we keep both, or we need to get back to Eric on this question. But, Eric, we we do see the question. So if we don't have the final answer today, we'll definitely get back to you. We know it exists for Viber. I don't have the final say here, to commit if it still exists on SentriX without the fiber. So that is something we'll need to validate. Other than that, I don't see any other open questions. Oh, Arian, you put a question in the chat, but that's okay. A very detailed question, but do you know if the new, WSUS integration gets updates, on the installed Windows built number, the o l OS built revision? So it is indeed a a detailed question, but you might know the answer, Rich. Yes. I believe one of the properties are the updated Windows build number. But there is actually inside the integration itself, and I'll link out the the actual integration guide, but it does provide the additional properties that are pulled in from the WSUS integration. Okay. Thank you so much. I see Eric, in the meantime, confirmed they have both SentriX and Fiber in our in their tenants. So okay. That is good background information. And Arian says thanks as well, and thank you, Rich. Question from Larry. Leadership wants to wants armies to serve as our single point of truth. I'm new to the platform. Is this possible? No. This is not a dumb question. Absolutely not. There are no dumb questions. Yes. This that's even how we promote it. Right? So, one of the marketing based messages that we sent out in the past is to say this is a single source of truth. Single source of truth, meaning we gather information from, literally hundreds of integrations with your existing tools. You saw the level of detail that we put into new integration and enhancing existing integrations. So the single source of truth is, partially because we can, rely on integrations, as Rich pointed out. But the other very important part of this single source of truth is that we gather, telemetry data from the network. So, we have active and passive ways of collecting the data, and it's the combination of the telemetry and the integration and the enrichment that we do with the Armistice Asset Intelligence Engine monitoring 5 plus billing assets, combination of all 3 that leads, ideally to this single source of truth. So, yes, Larry, absolutely very good question. If you want to know more, feel free to to get in touch with us. We'll provide you with with more details. But this is actually one of the basic, foundational promises of the platform. So, absolutely right. Thank you, Eric. Alright. I see no more open questions. So, hopefully, this has been crisp and clear. Again, sorry for small glitches on the new platform. This is a learning curve for us as well. Next time, the videos will have sound, and we'll make sure to, address all of these questions properly just like we we try to answer today. So I'm gonna give you back 10 minutes, and, thank you so much for attending webinar today. We'll be speaking in a few months, and don't forget the deep dive session next Wednesday. You can register on the, armies community for that upcoming session. Thank you. Have a have a good day. Bye bye. Thanks, Al.