Hardware Appliance
Dedicated physical appliance for high performance, full hardware control, and redundancy support.
Datasheet
Global Security Management
Blockbit GSM
Centralized management, integrated Analyzer and SIEM Module
Centralized managementIntegrated AnalyzerSIEM Module
About Blockbit GSM
Blockbit GSM (Global Security Management) is the solution responsible for the centralized management of the Blockbit platform, enabling unified administration of multiple devices and security capabilities distributed across the infrastructure. Integrated into the Blockbit Platform ecosystem, GSM acts as the control point that simplifies operations, consolidates policies, and improves efficiency in complex environments.
The solution combines management (Manager), analysis (Analyzer), and native SIEM capabilities, enabling standardized configuration distribution, log collection and normalization from NGFWs and compatible external sources, event correlation, alert investigation, and centralized security posture visibility.
Combined in the SIEM Module, these capabilities deliver security dashboards for SOC operations, MITRE ATT&CK tactic and technique mapping, correlation rules, and advanced event investigation in the same console where policies are managed.
Blockbit GSM also provides intuitive and scalable operations with automated provisioning, device inventory, policy management, and advanced data analytics.
Deployment Options
Virtual Appliance
VM compatible with VMware ESXi, XenServer, KVM, and ProxMox. Deployable in public clouds (AWS, Azure, Oracle, Google, IBM).
- Virtualization
- VMware ESXi | XenServer | KVM | ProxMox
- Interface
- Portuguese BR, English US, and Spanish ES
- Public Cloud
- AWS | Azure | Oracle | Google | IBM
Centralized Management
Devices, Inventory, and Deployment
- Centralized management of multiple NGFWs (physical and virtual)
- Inventory with name, model, version, license, and real-time status
- Organization by groups and communities (multi-tenant)
- Online geolocation map visualization (Geomap)
- Device Templates with presets: UTM, IPS, ATP, SWG, or Custom
- Configurable modules: Firewall, Proxy, Web Cache, Web Filter, Threat, IPS, SD-WAN, DHCP, DNS
- Individual and batch Zero Touch Provisioning (ZTP) (Batch Provisioning)
- Automatic network configuration: hostname, DNS, NTP, gateway, interfaces, and zones
- Automatic application of templates and policies on NGFW first boot
- Centralized backup with restore for managed devices
- Reboot, remote shutdown, and centralized update with rollback
- Management automations: rule synchronization and centralized orchestration
Policies, Profiles, and Objects
- IPv4 and IPv6 policy packages with versioning and version control
- Pre Rules / Local Rules / Post Rules ordering for prioritization
- Automatic validation of conflicts and redundancies between policies (IPv4)
- Usage count (hit count) per rule for performance optimization
- Rules with expiration date and time/period-based activation (Schedules)
- Centralized profiles: Web Filter, App Control, Threat, IPS, SSL Inspection, SD-WAN
- Objects: Addresses, Services, Time, Schedules, Dictionaries, Contents
- Centralized users and groups with zone-based authentication
- Deployment with approval workflow, audit, scheduling, and rollback
- Cloning of profiles and policies for fast replication
- Integrated QoS support in policies with Traffic Shaping
- Support for authentication server groups (AD, LDAP, Radius)
SD-WAN Orchestration
- Centralized orchestration of SD-WAN profiles across multiple NGFWs
- Profile types: Load Balance, Failover, Spillover, and Dynamic Selection
- Configurable Monitoring Interval (in seconds) and Fail Ratio (1-100%)
- Monitoring Targets with virtual IPs and connectivity tests
- SLA metrics per circuit: Jitter (ms), Latency (ms), and Packet Loss (%)
- Inbound/Outbound monitoring (RX/TX bits) per WAN circuit with history
- Per-interface statistics: packet ingress/egress, drops, and errors
- SD-WAN Services with prioritization by port, protocol, and application
- Application-Aware Routing (AAR) with dynamic best-link selection
- WAN Aggregation and Link Failover with automatic failure detection
- Orchestration of site-to-site, Full Mesh, and Star (HUB-Spoke) VPNs
- Visualization of jitter, latency, and packet loss per link and per circuit in Analyzer
Application Observability
- Traffic identification by application, independent of port/protocol
- Automatic real-time application classification
- Per-application metrics: latency, jitter, and packet loss
- Application vs. link (WAN/SD-WAN) correlation for performance analysis
- User experience (QoE) analysis per application
- Real-time application degradation detection
- Flow analysis with drill-down to the individual flow level
- Performance and traffic behavior monitoring per application
- Correlation between bandwidth consumption and performance per application
- Unified view: network, security, and application performance
Analyzer, SIEM, and Reports
Analyzer, Dashboards, and SIEM
- +90 pre-built views distributed across 6 analysis modules
- Overview: consolidated security dashboard with blocked and alerted intrusions (IPS), advanced threats and malware (ATP), denied applications (App Control), and environment Risk Index
- Impact severity, intrusion and threat time series, attack origin by country, and rankings of sources, destinations, intrusion classifications, malware, malicious domains, and blocked applications — with global filters by period, device, and module, and TV Mode for continuous display in NOC/SOC
- Firewall: Geolocation, Zone Traffic, Top User, Top Service, Top Source, Top Policy
- Web Filter: Allowed/Denied Sites, History Categories, Domains, Profiles, Content Types
- Application Control: Top Allowed/Denied Apps, Top Allowed/Denied Categories, History
- IPS: Alerted/Blocked, Geolocation, Impact High/Medium/Low, Layer 3 Protection
- Threat Protection: Threats/Malwares History, Malicious IP Classification, Top Threat Types
- User Behavior: Network Traffic, Policy/App/Web Usage, Threat/IPS per user
- Custom dashboards for personalized traffic visibility
- Multi-device combined filters (src, dst, protocol, user, threat)
- Time correlation: Today, Yesterday, Last 7/30 days, This/Last Month, By Date/Period
- Correlation Rules: correlation engine with a pre-defined library and custom rule creation for pattern identification, event chaining, and alert generation from multiple log sources
- MITRE ATT&CK: alert enrichment with framework tactics and techniques across Dashboard, Intelligence, and Framework views
- Alert evolution over time, tactic distribution, attacks by technique, tactics and techniques per agent, with agent exploration and report generation directly within the view
- Active response with automatic host blocking based on correlation rules
- Drill-down with automatic redirection to detailed Events
Monitoring and Performance
- Real-time status and performance monitoring of equipment
- Site-to-site and client-to-site VPN tunnel status (Up/Down/Connected)
- Visualization of remote users connected via VPN with session details
- Per-application performance with jitter, latency, and packet loss
- WAN/SD-WAN link performance with comparison between connections
- CPU, memory, disk, and storage monitoring per device
- HA monitoring: Cluster Status, Uptime, Connection, and Sync Status
- Packet capture (PCAP) per IPS rule for forensic analysis
- Integration with external monitoring tools via SNMP
- Geomap for geographic visualization of devices and alerts
- MTTR reduction with advanced troubleshooting and correlation
Analyzer, SIEM, and Reports
Reports and Business Intelligence
- Analysis types: Network Traffic, Policy Usage, Web Filter, App Control
- Analysis types: Intrusion Prevention, Threat Protection, User Behavior
- Log type: custom queries with CSV export
- SIEM executive security report in PDF: alerted × blocked events, origin by country, High, Medium, and Low risk classification, and rankings of categories, classtypes, sources, and destinations
- Custom Analytics integrated with Discover, Visualize, Dashboard, and Timelion tools
- Data sources: general logs, application traffic, and SD-WAN metrics
- BI fields: jitter, latency, packet_loss, bandwidth, protocol, timestamp
- Quality reports by application and by link (SD-WAN aware)
- Performance history: latency, jitter, and loss by period
- Duplication of existing reports for quick customization
- Scheduling: one-time, weekly, and monthly with automatic email delivery
- Export in HTML, PDF, and CSV; charts in SVG and PNG
- Logo and footer customization per report (Custom Branding)
Loggers, Events, SIEM, and Differentiators
Loggers and Storage
- Multiple Loggers: Standalone and Integrated
- Logger Cluster with HA, automatic failover, and real-time replication
- Virtual IP, Heartbeat, configurable synchronization, and Virtual MAC
- Scalable indexed log storage capacity (scalable per environment)
- Automatic log rotation by disk percentage and period (days/months/years)
- Automatic backup to remote storages: SMB, NFS, and SFTP
- Configurable retention by number of backups and disk usage percentage
- Log indexing for accelerated search without opening old files
- Consolidated logs by Device or group of Devices
- Graphical visualization of total logs generated by period
- CPU, memory, disk, and storage monitoring per Logger
- Centralized backup history with restore and execution status
Alerts, Events, and Advanced Search
- Events with near real-time visualization by logger or group
- Alerts: security alert triage by Logger or group of Loggers, with filtering by log type, Log Analysis with Top Hits by selectable field, and occurrence history by period
- Ingestion and analysis of security events from external sources via syslog, with Decoders for parsing and normalization, expanding visibility beyond Blockbit devices
- Pre-built filters and security indicators: open, critical, and high alerts, involved hosts, and category groupings
- Query Editor with 30+ filters: logtype, src, dst, sport, dport, protocol, service
- Filters: devin/devout, zonein/zoneout, client_mac/user/ip, geoip_src/dst
- Filters: rule_name/action, web_category/site/method/mime, app_name/category
- Filters: ips_profile, malware_file/md5/status/name, threat_class/category/sid/impact
- Operators: Contain, Not Contain, Equals, Not Equals with editable string
- Save and reuse custom queries (Save Query)
- Performance analysis and issue detection based on logs
- Top Hits, History (bar chart), and Log Events with detailed Event View
Technical Differentiators
- Application-oriented observability with performance metrics
- Correlation across network, security, and performance in a single platform
- Native SIEM integrated with centralized management: policy, logs, and detection in the same console
- Event mapping to the MITRE ATT&CK framework for investigation and contextualization of observed tactics and techniques
- Correlation rules and validation via Log Test prior to activation
- Unified view of distributed environments (branch offices, data center, cloud)
- Regulatory compliance aligned with Marco Civil da Internet
- MTTR reduction with advanced troubleshooting and per-flow drill-down
- Integrated Business Intelligence for advanced analytics and customized reports
- Positioning as an observability platform beyond security
- TCO reduction through centralized management of thousands of NGFWs
- ROI maximization in highly distributed multi-site environments
Administration, HA, and Integrations
Administration and Security
- Simultaneous access by multiple administrators with change locking
- Read-Only and Read-Write profiles per administrator
- Authentication via LDAP, AD, SAML, and Radius with SSO and MFA/2FA
- X509v3 certificates and support for revoked certificates (LCR)
- Identity Provider: Service Provider and Identity Provider (SAML)
- Granular access control and Access Control
- Audit Log with full tracking and detailed Audit View
- Configuration viewing and comparison with AI support
- Firmware and patch upgrades via management interface with rollback
- Configurable Login Disclaimer on the GSM authentication page
- Multi-tenant environment with communities
- GSM Custom Branding (logo, colors, favicon, background, page title)
High Availability (HA)
- GSM Manager HA Cluster: Primary + Secondary (standby)
- Loggers HA Cluster: Primary + Replica with Virtual IP
- Automatic failover with configurable heartbeat (interval in seconds)
- Up to 3 redundant Peer IPs with Virtual MAC and Sync Interval
- Resilient synchronization with integrity validation prior to replication
- Automatic reapplication of interrupted deploys after failover
- Email notification on failover and synchronization events
- Manual (Sync Now / Active Now) and automatic (Auto Activation) activation
- Cluster Status with Local/Peer State, Uptime, Connection, and Sync Status
CLI, API, and Integrations
- CLI with +70 commands: ping, traceroute, tcpdump, netstat, arping, telnet
- Network CLI: set-network-interface/dns/gateway/hostname/timezone
- Management CLI: reboot, shutdown, reset, passwd, rewizard, enable-root
- Logger CLI: logger-config, logger-enable, logger-key, logger-devices-add/list
- Debug CLI: debug-backup, debug-ha, debug-sync, debug-deployer, debug-rotation
- SNMP CLI: enable-snmp, disable-snmp; Update CLI: update-gsm, upgrade-blockbit
- RESTful API with JWT authentication (bearer token) on port 3002 (JSON)
- Endpoints: /auth/login, /api/appliances, /api/policies, /api/ips, /api/traffic
- API filters: interval_type (hour/min/d/m/y), init_date/end_date, device_id
- Alerts via email (SMTP), SNMP, and Syslog with integration with external monitoring and Geomap
- Reception of logs and events from external sources for use in the SIEM Module, according to the formats and decoders supported by the version
- SSL and IPSec VPN (client-to-site) with Blockbit Client for Windows