When using cognitix Threat Defender in your switched network, keep in mind that only traffic passing Threat Defender can be analyzed.

Due to the network switch characteristics of Threat Defender, only the sending and receiving ports can see the traffic.


Therefore, position cognitix Threat Defender in front of the switch to protect the network behind it.


If you just want to monitor the network traffic for the devices connected to a switch, you can setup the switch to send all the packages as a copy to the device Threat Defender is connected to (mirroring or switch monitoring). Please check your switch documentation for this or contact the responsible support.

If you want to secure parts of your network, you have to be sure that all packages are sent through Threat Defender.

You can use a separate switch for the critical network part and connect Threat Defender between.


Alternatively, you can set up a VLAN-capable switch as port extender for Threat Defender.