Logs, read-only access and evidence: what each level gives you

Devexana works at three levels of access. You choose the level. Each level adds sources that answers and findings can cite.

• Level 1: logs and exports only. You give no device credentials. Devices and firewalls send logs to receive-only listeners on the appliance, and you import files.
• Level 2: read-only device and API access. Devexana reads switches, routers and firewalls over SSH and SNMP with read-only accounts. You can see the read schedule.
• Level 3: added context. Devexana adds your helpdesk, directory, port map, site file and monitoring. It also adds the extended switch read set, and firewall logs combined with the firewall's interface read.

The levels add up. Level 3 includes Level 2. Three Level 3 sources need no credential: the port map, the site file and DHCP lease files. You can also use them at Level 1.

You can start at Level 1 and give Devexana no device credentials. The sources on this page only read. In this release, changes to network-device configuration are disabled in code.

Level 1: logs and exports only

At Level 1, Devexana receives what your devices send and what you import. It does not contact your devices.

What Level 1 receives

• Syslog in RFC 3164 or RFC 5424 format, over UDP or optional newline-framed TCP.
• SNMP traps, version 1 and 2c.
• NetFlow version 5 and 9, and IPFIX.
• Files: documents, spreadsheets, port-map CSV files, DHCP lease files, and a site file for the campus map.
• Optional: firewall log files that your team pulls by hand. Devexana support or your installer loads them with an operator command on the appliance.

Each listener is off until an administrator turns it on. Listeners receive only. Their sockets cannot send, and Devexana blocks and logs an attempt to send.

What Level 1 shows

What Level 1 does not show

• Current port state, VLANs and PoE.
• Neighbours, and MAC and ARP tables.
• Configuration history and configuration posture checks.
• Neighbour links between switches.
• Alerts for logs from vendors other than Barracuda CloudGen. Devexana stores those lines and you can filter them, but it does not classify them into alerts.

What the assistant can conclude at Level 1

The assistant can cite what a firewall logged, what your files say and what a daily rollup counted. It cannot state the current state of a port or a configuration. When nothing relevant is stored, the assistant says so.

Set up Level 1

• Start with logs only: the step-by-step procedure.
• Syslog, SNMP traps and NetFlow: listener settings, ports and retention.
• Import files, port maps and DHCP leases: imports, port maps, DHCP leases and the site file.
• Firewall alerts and the daily brief: Barracuda CloudGen syslog alerts and the daily brief.

Level 2: read-only device and API access

At Level 2, Devexana reads your network devices on a schedule, with accounts that you create and restrict.

What Level 2 receives

• Over SSH, per switch: the running configuration once a day by default, plus an identity record.
• Over SNMP, per switch: interfaces and their state, VLANs, LLDP and CDP neighbours, the forwarding (MAC) table and PoE class.
• Through NAPALM getters, for families that support them: interface counters and environment data.
• Barracuda CloudGen over SSH: interfaces, version, high-availability state, routes and licences. This read includes no rules and no logs.

What Level 2 shows

• The switch faceplate: port state, VLAN, PoE class and the device on each port.
• Port trace, and neighbour links from LLDP and CDP.
• Inferred access points and phones, which wait for a person to approve them.
• Campus links between buildings.
• Configuration history, with a diff for each change.
• Posture checks on configurations, for example Telnet on or a default SNMP community.
• Duplicate MAC and address-conflict findings.
• End-of-life hints, and hints that a device matches a known-exploited vulnerability.
• The read-only command console on each switch page.

How often Level 2 reads

By default, Devexana reads each network device once a day. This limits the sign-in entries in each switch's authentication log. A person can request a refresh from the switch page. Every view and every citation shows when its data was read.

What Level 2 does not show

• Device state changes that scheduled reads do not capture. Received logs can contain events between reads.
• Error counters on families that Devexana reads only over SSH and SNMP.
• Firewall rules from the Barracuda CloudGen SSH read.
• Device up and down history.

What the assistant can conclude at Level 2

The assistant can state what a device reported at the last read, and when that read happened. Scheduled reads do not capture every state change. Received logs can contain events between reads. On a switch page, Devexana checks addresses, interfaces and people named in a drafted answer. Devexana rejects the draft if the evidence lacks any named item.

How Level 2 stays read-only

SSH commands must pass a read-only allowlist. SNMP uses GET and GETNEXT requests only. NAPALM uses getters only. Each read function stays off until an administrator approves it. In this release, changes to network-device configuration are disabled in code. Read-only sources describes each check.

Set up Level 2

• Create read-only accounts: create restricted read-only accounts.
• Switches over SSH and SNMP: switches over SSH and SNMP.
• API connectors and ticketing: firewalls, controllers and other applications through their APIs, and the Barracuda CloudGen SSH read.

Level 3: added context

Level 3 adds records from other sources. Check whether the records contain independent evidence before you use them to assess a finding.

What Level 3 adds

What changes at Level 3

• Person to device to port. Devexana joins directory, DHCP and helpdesk asset records to MAC and ARP tables. Each link has a confidence label.
• Ticket history. Answers cite helpdesk tickets next to a switch or a port, with their dates.
• More switch detail. Optics, PoE watts and CLI neighbours come from switches read over SSH with the extended read set.
• Monitoring state. PRTG sensor state appears per switch where a PRTG source exists.
• Confirmed placements. Campus placements in your site file replace the drafts that Devexana makes from host names.

Set up Level 3

• API connectors and ticketing: Freshservice, LDAP, Active Directory, Entra ID and PRTG.
• Import files, port maps and DHCP leases: port map, site file and DHCP leases.
• Switches over SSH and SNMP: the extended switch read set.
• Syslog, SNMP traps and NetFlow: firewall syslog.

Questions a network engineer asks, by level

The four tables below answer 20 questions at each level. Yes means Devexana shows or answers this from data it holds at that level. Partial means it shows part of the answer, and the cell says which part. No means not at this level. Level 3 includes Level 2.

Ports and device identity

Firewall logs and rules

Configuration and security

Monitoring and history

What each level needs from you

Network paths in this table go towards the appliance unless the cell says "from the appliance".

If the default listener port is unavailable, choose a port above 1024. Configure your devices to send to that port. Syslog, SNMP traps and NetFlow has the details.

What no level provides in this release

These gaps apply at every level. Plan to keep your current tools for them.

Choose a starting level

1. If device credentials need a security review first, start at Level 1. Start with logs only gives the steps.
2. Move to Level 2 one switch family at a time, as your team approves each read-only account.
3. Add Level 3 sources one at a time.
4. After you add each source, check its health state on the Connectors screen. Source health states explains each state.

Limits

What Devexana does not do (limitations) lists everything that Devexana does not do.