A10 Integration with Anomaly Detection

What this means is that if you already own or plan on acquiring such appliances, you can leverage all of Kentik Detect’s powerful Anomaly Detection system and couple it with A10 for mitigation.

To configure the Kentik end of an A10 TPS mitigation platform for use within policies, go to the Mitigation menu under the Alerts and click on the +Create Mitigation Platform, as shown in the screenshots below:

Matrix visualization

A “Matrix view” is now available in the Data Explorer, find it amongst the already existing Display Types section of the query side panel.

Here are a few examples of uses cases for Matrix Views:

• Transit providers might want to look at Top 10 Source ASNs vs Destination ASNs matrix of traffic. This might be a good way of trying to identify strategic content or eyeball prospects to engage in the future.
• Building a matrix of cross-PoP traffic for capacity planning purposes.
• Looking at PPS between different farms of servers or even between top talkers in a Datacenter setup…

Alerting v3 Updates

Minimum look-back for baselining

More details on Look-back Alert Policy settings in this Knowledge Base entry.

You can now use the Minimum Look-back setting to specify the minimum number of hours or days that baseline data collection is performed before a baseline is made available for comparison by alerting policies. 

In-policy creation of notification channels

More details on Alert Notification Channels in this Knowledge Base entry.

You now create a new notification channel from directly within the threshold notification-add function. 

Dashboard editing overhaul

Knowledge Base entries detailing Dashboard usage and creation are located here.

The dashboard layout infrastructure has been redesigned to improve speed and ease of use. This comes with a streamlined user experience as part of our constant effort to streamline usability of our most used features.

Subscriptions, aka Scheduled Exports

Exports and scheduled reports have been redesigned for ease of use. Here’s an example of the overhauled Email Subscription experience:

And the Export feature in Dashboards and Views updated experience:

BGP Status within device screen

Tags feature update

Tagging now supports regex for device names and interface fields, and supports IPv6.
As a reminder, a comprehensive table references all types of inputs for all of the available Tag Fields, it is located here.

For instance, if your interfaces always include consistent descriptions, you could potentially match said interface descriptions on either ‘PNI’ or ‘Peer’ or ‘customer’ and tag all the matches as ‘Peering’ to then be able to filter them in or out of any Data Explorer query.

Prettified JSON output to describe API calls

You can now see the API calls in Data Explorer as prettified JSON, making it much easier for your users to identify the fields at play in your API calls.

The idea here is to further simplify the task of integrating with the Kentik API under the following methodology:

1. Building a satisfactory View, tweaking it until it shows exactly what you are after
2. Exploring the resulting JSON
3. Building an integration

To describe the underlying API call of a given view, proceed as illustrated below – starts with clicking the Hamburger Menu icon on the top-right side of a view

Peering Analytics IPv6

Peering analytics now supports IPv6 as well as showing the full path on mouseover.

In graph zooming

Data Explorer now supports graph highlighting and click and drag operation on the timeline to zoom in to the selected timeframe. Following on to a horizontal click and drag, the side query panel will automatically update its “Time” fields and a zoomed-in graph will be spawned.

New ‘Table’ visualization type

A table view has been added to the existing display types on top of the existing chart types.

Beyond their basic appearance, Table views are highly customizable in terms of columns they display and can amongst others allow to build computed fields in a very comprehensive manner. These advanced options for the table widget are available by clicking on the hamburger menu at the top right end of the table component.

Table View Options details can be found in our Knowledge Base under this article.

Custom Dimensions

Custom Dimensions correspond to user defined Flow Enrichment Custom Columns. What that means in practice is that users are now able to programmatically enrich their flow data with columns (5 custom dimensions are allowed per account) that can be grouped-by, summed, max’ed, etc.

Unlike Tags or Saved Filters, Custom Dimensions only affect the flows being considered in a request. Custom Dimensions provide an efficient way of breaking down your visualizations by your own business contextualized data groupings.

Values for each custom dimension can be set via:

• Kentik Detect portal UI
• or programmatically via our API (link to Custom Dimensions in our API Sandbox here)

Interesting examples of how one would use Custom Dimensions include:

• Marking different types of customers: populating a_ customer_type _Custom Dimension based on the IP Ranges within which the customers are hosted.
• Marking arbitrary tiers of cheap to expensive destinations or sources by relying on source or destination ASNs.
• Marking Peering (paid, free), Transit, and IX traffic based on matching interface description.

The extensive documentation around Custom Dimensions can be found here in our KB

Saved Filters

The extensive documentation around Saved Filters is located here in our KB

Saved Filters are a new addition to Kentik Detect’s take on how to slice and dice data in the Data Explorer in an increasingly quick and convenient manner.

Remember the days where you needed to build a complex filter from scratch when going back to the Data Explorer screen? Those days are over. With Saved Filters, you can conveniently save filters you use on a regular basis and call them from the Data Explorer Filter section any time.

Here’s what filters look like now: If you were to build that filter of destination French ISPs every time you create a query, it could be quite a chore… here’s what your filter would look like:

Saved Filters to the rescue. Now you can now save that filter by clicking on the disk icon at the top of the filter group, and re-use it sometime later.

Voila! You can now invoke this filter any time directly from the filter screen:

Double-click the filter’s name and you can invoke its opposite, in this case filter on any destination ASN but the French ones you previously listed!

Additionally, Saved Filters are shareable between users at a company level, as well as Kentik offers common pre-set filters. To get a view of all filters, just hop on to Admin → Saved Filters:

In a future release, Saved Filters will adopt a library view to facilitate collaboration and sharing, so stay tuned!

IPv4 and IPv6 CIDR grouping/breakdown

When selecting dimensions in Data Explorer, users now can configure separate aggregation/grouping levels for IPv4 or IPv6, from a single location in the Query Side Panel:

Kentik support for nProbe

Detailed steps to get setup with nProbe and Kentik are detailed over in this Knowledge Base section.

nProbe now allows you to export flow data to Kentik Detect’s Flow Data platform, unveiling a whole new array of host-level traffic and performance info.While previously limited to flow-data from your networking gear, Kentik now brings server/data-center level metrics to the powerful performance analysis tools it already offers (Custom Dimensions, Tagging, Filtering…).

With nProbe able to send flow data to the Kentik Detect big data platform, the realm of query-able metrics now extends to network performance for such devices, including:

• Retransmits/s, %Retransmits,
• Out of Order/s, %Out of Order,
• Fragments/s, %Fragments,
• RTT/2 Client latency
• RTT/2 Server latency
• RTT/2 Application latency

This first set of performance metrics paves the way for the future addition of application-specific Dimensions to enrich flows exported from servers.
The screenshot below shows how registration of nProbe hosts happens in the Kentik Detect Portal:

Multiple time series

The multiple time series view options will soon enough be detailed in this section of our knowledge base.

Currently in its Beta stage, this feature now allows you to combine multiple graphs in the Data Explorer (and dashboards) into one single, comprehensively configurable representation. This can prove handy when trying to establish causality between different observed phenomena.

Below is a simplistic view of Destination and Source traffic broken down by ASNs: