Support & Integration

7.1 Supporting Infrastructure Overview

A complete NTA/AD deployment requires a carefully planned supporting infrastructure ecosystem that extends well beyond the core sensor and analytics platform. The companion equipment — including network TAPs, out-of-band management switches, threat intelligence servers, SIEM integration gateways, UPS power protection, and KVM console switches — must be specified, sized, and deployed as an integrated system. The diagram below illustrates all supporting equipment integrated within a standard rack deployment, showing the physical connections and logical relationships between each component.

Figure 7.1: Integrated rack ecosystem diagram showing all NTA/AD supporting equipment — TAP aggregator, OOB management switch, NTA sensor, analytics platform, PCAP storage, threat intelligence server, SIEM gateway, UPS, and KVM console — with monitoring (blue), management (gray), and power (orange) connection types.

7.2 Network TAP and Aggregation Requirements

Network TAPs are the foundational supporting component for any NTA deployment. The TAP aggregator consolidates traffic copies from multiple monitored links and presents them to the NTA sensor on a single high-bandwidth monitoring port, reducing the number of sensor ports required and simplifying cable management. TAP selection must account for the physical media type of each monitored link, the required monitoring bandwidth, and the need for fail-safe operation in the event of power loss.

7.3 Out-of-Band Management Network

All NTA/AD components must be managed through a dedicated out-of-band (OOB) management network that is physically and logically separate from the production network being monitored. The OOB management network ensures that management traffic cannot be observed by the NTA sensors (preventing a circular monitoring situation), that management access remains available even if the production network is disrupted, and that the attack surface of the NTA system is minimized by limiting management access to a controlled network segment.

The OOB management switch must support 802.1X port authentication to prevent unauthorized devices from connecting to the management network, VLAN segmentation to separate management traffic from other OOB uses, and SNMP v3 or SSH-based management for the switch itself. IPMI/iDRAC/iLO interfaces for all server hardware must be connected exclusively to the OOB management network.

7.4 SIEM and SOAR Integration Requirements

Integration with SIEM and SOAR platforms is a core operational requirement for NTA/AD systems. The integration must be designed to deliver high-fidelity, actionable alerts to the SIEM while minimizing noise, and to enable automated response actions through the SOAR platform. The following table summarizes the integration requirements for the most common SIEM and SOAR platforms.

7.5 Threat Intelligence Feed Integration

Threat intelligence (TI) feeds provide the NTA/AD system with up-to-date indicators of compromise (IoCs) — including malicious IP addresses, domain names, URL patterns, and file hashes — that enable signature-based detection of known threats. The TI integration architecture must support multiple feed sources, automatic feed refresh, indicator deduplication, and confidence scoring to prioritize high-fidelity indicators over noisy or outdated ones.