# Aviz vASN for Public Cloud

Cloud-Native Network Visibility, Optimized and Actionable

**Aggregate, deduplicate, enrich, and intelligently broker cloud traffic, delivering only the right data to your security and observability tools.**

Modern cloud environments generate massive east-west and north-south traffic across VPCs, tiers, and workloads.

**Replicating traffic at scale introduces duplication, overhead, and cost.**

### Sending raw, replicated, or mirrored traffic to tools leads to:

#### Tool overload and packet duplication

#### Increased cloud egress and processing costs

#### Limited application context

#### Inefficient threat detection

Aviz vASN transforms raw traffic into optimized, enriched, and tool-ready intelligence.

## How It Works

Aviz Deep Network Observability Intelligent Fabric

Figure 1: Aviz Deep Network Observability Intelligent Fabric

### Traffic Acquisition

### vTAP-Based Collection

- Lightweight agents as taps on workloads (VMs)
- Visibility into east-west and north-south traffic, including intra-host
- Agent-side filtering and packet truncation to reduce data volume at the source
- Fine-grained telemetry where native mirroring is limited

### Native Traffic Mirroring

- Uses native cloud features (e.g., AWS VPC Traffic Mirroring)
- Replicates traffic from instance network interfaces (ENIs)
- Captures traffic across VPCs, subnets, and application tiers
- Scales across multi-VPC and multi-account environments

### Centralized Processing via vASN

- Aggregates traffic from distributed sources
- Applies filtering, deduplication, and enrichment

### Data Transformation Pipeline

- Aggregate → Consolidate flows across tiers
- Optimize → Remove noise and reduce volume
- Deduplicate → Eliminate redundant packets
- Enrich → Add application + metadata context
- Broker → Distribute selectively to tools

### Tool Delivery

- Security tools (NDR, IDS)
- Observability platforms such as SIEMs, NPM, and APM
- Forensics and analytics systems (Packet recorder)

## Core Capabilities

### 1. Intelligent Traffic Aggregation

- Unify traffic from multiple VPCs, availability zones, and application tiers into a single logical pipeline.

### 2. Advanced Deduplication

- Eliminate replicated packet redundancy across:
  - Multi-Availability Zone (AZ) deployments
  - Multi-tap architectures
  - East-west and north-south traffic

**Outcome:** Reduced tool load and improved detection accuracy.

### 3. Metadata & Application Enrichment

- Enhance packets with:
  - VPC / subnet/instance context
  - Application tier tagging (Web, App, DB)
  - Cloud-native metadata (tags, labels)

**Outcome:** Faster investigation and contextual threat detection.

### 4. Policy-Based Traffic Brokering

- Precisely deliver the right traffic to the right tools:
  - Filter by protocol, port, workload, or tag
  - Route different traffic streams to different tools
  - Avoid unnecessary data duplication downstream

### 5. Cloud Cost Optimization

- Reduce:
  - Tool ingestion costs
  - Data processing overhead
  - Cloud egress charges

**Outcome:** Lower TCO without compromising visibility.

## Use Cases

### Network Threat Detection (NDR)

- High-fidelity traffic for better detection

### East-West and North-South Visibility

- Monitor lateral and ingress/egress traffic

### Tool Optimization

- Reduce IDS/IPS and SIEM load

### Compliance & Forensics

- Maintain high-quality packet data

## Business Outcomes

### Threat Detection

Improved threat detection accuracy

### Tool Fatigue

Reduced security tool fatigue

### Cloud Costs

Lower cloud operational costs

### Incident Response

Faster incident response with enriched context.