Notification channels are assigned in an alert policy to determine who will be notified when there’s a change in the alert state, e.g. an alarm is triggered by one of the alert’s thresholds. Each channel represents a notification type (e.g. email) and, where applicable, one or more notification targets (e.g. a set of email addresses). Kentik Detect supports multiple notification types (e.g. email, JSON POST Webhook, PagerDuty, Slack Channel and system log) so that each customer organization can use its prefered methods of notification. As shown below,  we’ve now added a couple of additional options for notification types: OpsGenie and ServiceNow.

For further information on Notification Channels, please see the Alert Notification topic in the Kentik KB or contact the Kentik Customer Success team at support@kentik.com.

Bracketing allows you define from two to five ranges (brackets) of values and assign various colors to the brackets (see Bracketing Options dialog below) so that you can see at a glance the range into which the current value falls.

If bracketing is turned on for a given query the colors will be applied to the query’s returned table. Depending on the visualization type (see Chart View Types) these colors may also be applied to the visualization itself.

We’ve recently added Time Series Line Graph to the list of view types that support bracketing for visualizations (see Bracketing View Types). In this case, as shown below, the boundaries between brackets are represented by the colored horizontal lines that run across the chart at 100, 150, 200, and 400M.

For additional information, please see the Bracketing Pane Settings topic in the Kentik KB or contact the Kentik Customer Success team at support@kentik.com.

Both Custom Dimensions and Flow Tags allow you to label flow records based on criteria defined in advance and evaluated at ingest. As announced in the HSCD topic of our May/June 2018 Product Update, our backend engineering team has been hard at work re-engineering these systems under the hood to drastically increase their capacity, scalability, and agility. As of September, all Custom Dimensions natively support this increased scale.

As part of enhancing the usability of Custom Dimensions and Flow Tags, we’ve also added a new Batch API that simplifies management by enabling bulk loading of either Populators (for Custom Dimensions) or Tags. To help you get started, we’ve posted a Hypertagging API in GitHub that you can use in Python to call our Batch API. For additional information, please refer to the Batch API topic in the Knowledge Base or contact the Kentik Customer Success team at support@kentik.com.

Kentik Detect has long supported two-factor authentication (2FA) which strengthens security by requiring not only a username and password for login, but also the additional “factor” of a token that is generated either by a TOTP (Time-based One Time Password) app on different device (e.g. Google Authenticator running on your mobile) or by a YubiKey. Instead of requiring that you choose a single such method, we now enable you to create a list of 2FA methods, any of which will be accepted at login.

You specify your 2FA methods on the Authentication tab of your User Profile (choose My Profile from the drop-down menu at the right of the main portal navbar). As shown below, you’ll see a list of currently enabled 2FA methods (if any), as well as buttons that enable you to add a YubiKey or TOTP method. For further information on adding methods, see the Register YubiKey or Register TOTP topics in the Kentik KB; for information on login procedures see Portal Login. Need help? Contact the Kentik Customer Success team at support@kentik.com.

Tenant “spoofing” enables you to see your My Kentik portal as if you were a specific user assigned to a specific tenant, so that you can evaluate for yourself how that tenant’s current portal configuration is meeting users’ needs.

Instead of having to create an account for yourself in the userspace of a tenant, you can now simply click the Open in Tenant View button on the My Kentik Portal page. In the resulting dialog (shown below left), select a tenant and an individual user to spoof. When you’re done, click on the user menu at the right of the navbar and choose Stop Spoofing from the drop-down menu (below right).

For additional information, please see the My Kentik Portal topic in the Kentik KB or contact the Kentik Customer Success team at support@kentik.com.

Kentik Detect has long offered the ability to resolve IP addresses to domain names. When Enable Reverse DNS Lookups is on (shown below left; see the Knowledge Base topic on Query Advanced Options), the domain names are displayed next to the addresses in any table returned from a query using source and/or destination IP address as a group-by dimension.

But our public DNS lookup obviously isn’t able to resolve IP addresses in a private (RFC 1918) namespace. Until now that has resulted in the display of a hyphen (”-”) where the names associated with a private address would otherwise be (see below right).

We’ve now addressed this with Custom DNS, a feature that enables you to designate one or more DNS servers for Kentik Detect to use for reverse lookups instead of our default public DNS server. The result is that the names associated with IP addresses will be displayed according to your designated reverse DNS servers rather than the Kentik-default DNS server. Using your dedicated DNS servers will result in Kentik Detect being able to display not only public but also private names.

Configuring Custom DNS is very straightforward, involving just a few clicks. Navigate to Admin » Custom DNS, where you’ll find the Custom DNS page shown below. In the callout near the top of the page you’ll see the IP address from which Kentik will query your designated DNS servers; you’ll need to be sure that the servers you designate are configured to allow queries from this address. Enter the IP of a DNS server into the Add DNS IP field, then click the Add button. If the IP address is valid then it will be added to the DNS Servers list at right. You can add multiple DNS servers to the list and queries from Kentik will be evenly distributed across the set.

After configuring a DNS server, you can use the Verify Reverse DNS Lookup button to open a dialog (shown below) in which you can test the lookup of any IP address.

For additional information, please refer to the Custom DNS article in the Knowledge Base. As always, for further information or help you can also contact the Kentik Customer Success team at support@kentik.com.

Back in Q2 of this year, we announced the My Kentik Portal, which enables curated, self-service network traffic visibility for downstream customers (see the My Kentik solution brief). Building on this initial launch, we’ve subsequently been improving the feature-set to add value for our customers and their customers (internal or external), whom we refer to as “tenants.” A number of these major updates were completed in September, including the ability to expose tenants to alerts, a redesign of the tenant configuration UI, and a “spoofing” capability that allows customers to see the My Kentik portal through the eyes of an individual tenant. Here’s a closer look at these improvements.

Alerting for Tenants

One of the key features of Kentik Detect is its ability to generate alerts based on highly customized network traffic conditions that are defined in Alert Policies. If you’ve configured policies you can now enable the tenants in your My Kentik portal to receive alerts from some or all of those policies. And you can even tailor the thresholds that will cause those policies to trigger alerts for a given tenant.

There are two ways to enable your tenants to view alerts in the My Kentik portal. One is by adding one or more of your policies to the Tenant Default Alert Policies list so they can be seen by all of your tenants (see Tenant Default Content below). The other is to add one or more policies to an individual tenant (shown at right), so that the policies can be seen by any user assigned to that tenant. You do that in the Add Tenant dialog (opened by the button of the same name) or Edit Tenant dialog (opened by clicking on a tenant in your Tenant List). These tenant settings include an Alert Policies Settings pane where you can choose the policies to make available to the users assigned to that tenant.

Once you add one or more policies, the Alert Policy Settings pane will resemble the image below. If individual thresholds are shown for the policy you can make tenant-specific adjustments to the criteria that will trigger an alert to be displayed in the My Kentik portal.

Once you’ve added alert policies to a given tenant’s configuration, the My Kentik portal for that tenant will include icons for Alarms and Alert History (shown at right). When tenant users click on Alarms they’ll see a list of of Active Alerts. When users click on Alert History they’ll see a list of alarms, mitigations, and matches for a specified time range (see Alert History).

Tenant Default Content

As mentioned above, you now have the ability to assign default content that will be visible to the users of all of your tenants. You specify default content on your main My Kentik Portal admin page under Tenant Defaults, where you’ll find the Views and Alert Policies settings (shown below). Each is a drop-down menu listing the existing views or alert policies in your organization. You can choose any item from the list, and add as many defaults in each category as you’d like to make accessible to all of your tenants.

• Connectivity Type
• Interface Description
• Network Boundary
• Provider

Custom Dimensions provide a mechanism by which Kentik Detect customers can effectively add custom columns — queryable dimensions — to the main tables of the Kentik Data Engine (see Main Table Schema). Our developers have worked up a major upgrade to our Custom Dimensions engine, which we’re calling Hyperscale Custom Dimensions (HSCD). This new approach increases the capacity and agility of Custom Dimensions by eliminating many constraints of the legacy system, particularly with regard to the cardinality of values.

HSCD Availability and Use

While HSCD is already fully functional, our engineering team is currently completing final refinements in preparation for General Availability release. In the meantime, we encourage you to get familiar with it to see what it can do. So we’re launching HSCD in preview mode and putting it into the hands of customers who request it from Customer Success (support@kentik.com).

Note that to define HSCD dimensions you’ll use our new HSCD API. Instead of exposing direct REST endpoints like we do for our query and admin APIs, we’re making HSCD available via an Open Source client library, written in Python, that we’ve published on GitHub. We will also soon add the API itself to our API Tester and publish API documentation.

New Custom Dimension UI

Once we activate the new feature for you, you’ll be able to use the Python client to push Custom Dimension mappings, and you’ll see some changes to the controls in your Custom Dimensions dialogs (see screenshot below). The new UI allows:

• Paging when there is a large number of populators.
• Searching for Custom Dimension values across a large number of populators.
  
  

Stay tuned to this space as more details will follow soon about the powerful features that are enabled by the increased scale made possible by HSCD.

This month of August, we're releasing a sum of granular features, read on for more details.

New Site-based Dimensions

We’ve added the new dimensions “Site Country” and “BGP UE Site Country.” While the existing  “Source Country” and “Dest Country” dimensions tag traffic based on the country associated with the source or dest IP of the flow, these new dimensions tag flows based on the country associated with the PoP (and device) that the flows were received from. This allows you to filter or segment traffic by the geolocation of the network entry or exit point, rather than the geolocation of the host(s) that originated or terminated the traffic. These dimensions were added to aid traffic engineering, peering, or customer traffic analyses that rely on understanding the geolocation of network entry and exit points.

Major Update to Geo HeatMaps

Region Maps (a.k.a. sub-country) have been revamped. As shown below, the regions are now fully modeled in the mapping engine, providing easy-to-read region-based heatmaps.

We also now support heatmaps based on Custom Geos (described above), as shown in the example below.

Expanded Service Names

We’ve expanded the list of Service names that are displayed with well known TCP and UDP Ports when using the Source/Dest Proto:Port dimensions. While we previously resolved only about 2000 service names, we now include approximately 12,000 port/service name mappings, and any port number listed in the public NMAP dictionary is available for resolution. NMAP sources this dictionary both from IANA’s allocation master file and their own curation efforts.

New Filter for Interface List

We’ve added an “SNMP but no Flow” filter to narrow the interfaces listed in the Interfaces List (Admin » Interfaces). Applying the filter will restrict the list to interfaces that should have flow enabled but do not. This is particularly useful when troubleshooting ports that have traffic reported via SNMP but show no flow, the most likely cause being misconfiguration ot the flow-generating device.

New View Types

We’ve added two new types of visualizations (see Chart View Types):

• Sunburst visualization: A density-based view in which the dimensions that make up the key definition are represented as concentric rings that are segmented into wedges representing the top-X results (see Sunburst Chart).

• Horizon charts: A compact time-based visualization in which each of the top-X rows is represented by one “lane” into which different-colored bands of results are overlayed, with higher volume results in front (for a fuller explanation, refer to Horizon Chart).

Enhanced Usability and UI

We’ve made a number of recent usability and UI improvements:

• Alerting Device Selector: The Device selector in alerting now matches the Device selection dialog used in Data Explorer, which enables device selection by Device Labels.
• Device Labels Scalability: Additional colors have been added to allow a greater range of Device Labels.
• Nesting in Saved Filters: Filters can now be saved even if they contain one or more nested filter groups. Additionally, as shown below, filters with nesting (saved or ad-hoc) can now be used in Alerting (Dataset tab of Alert Policy dialog).