Which of the following are valid Network Traffic Analysis detectors in vDefend ATP? (Select all that apply)

VMware vDefend Advanced Threat Prevention (ATP), formerly NSX ATP, includes Network Traffic Analysis (NTA). NTA uses unsupervised machine learning to establish a baseline of normal network behavior and then detects anomalies. Its detectors are designed to identify suspicious patterns indicative of threat activity. This includes detecting DNS tunneling, recognizing unusual traffic patterns that deviate from the baseline, and identifying scanning activities like vertical port scans.

C. Password brute force: While the resulting traffic might create an anomaly, password brute force is typically an application-layer attack detected by specific IDS/IPS signatures or log analysis, not a primary NTA behavioral detector.

1. VMware Tech Zone, "NSX Advanced Threat Prevention," Section: "Network Traffic Analysis (NTA)." This document explains that NTA detects anomalous network activity, providing examples such as port scans and unusual traffic.

2. VMware NSX Advanced Threat Prevention Datasheet. This document outlines the capabilities of the NTA component, which include identifying threats like lateral movement, port scanning, and anomalous network behaviors.

3. VMware NSX 4.0 Security Configuration Guide, "Detecting Network Threats," Section: "Network Traffic Analysis Events." The guide lists event types that NTA can generate, which correspond to detections like port scans and other anomalous behaviors.