Cisco Secure Network Analytics vs. Datadog vs. Kaspersky Anti Targeted Attack Platform

Cisco
Secure Network Analytics is a compulsion to any organization looking to secure their network in silence with a complete record and analysis of the threats. All the critical information of the client is also preserved for instance and assistance for future needs. Cyber-attacks can’t even think to roam about your
network in any case.

Incentivized

Datadog works really well with complex microservices architecture like any E-commerce platform which will be having multiple services but they all are interdependent to others so in this scenario Datadog will be best to monitor these as it will show the transactions also between those microservices. If you are using multiple services in your architecture whether it will be cloud services or on prem services Datadog will be the best choice to monitor all those service with in Datadog so that you can see everything in a single place. But if you are having small architecture and few services in that then in that scenario you can use Datadog but it will be little costly as compared to other but obviously the features are very well.

Incentivized

I would say it is less appropriate for an organization which is looking to implement a tool within a short period of time. However, we found support on the web forum as well as from support team and were given solutions always. It was somewhat a relief for the users. We were not in a position to provide further IT security resources. And Anti Targeted Attack Platform did not require such. The tool was able to identify and eliminate a critical threat right after the implementation.

• It's really good at mapping out like what applications are, like who's talking to what. To see if someone thinks that a particular application is only being used a certain way and we can validate what's talking to that system with the tool.

Incentivized

• Create Dashboards as per application, environments, and Custom metrics in one panel.
• Log aggregation, one-stop Application monitoring tools for the whole infrastructure.
• Playbooks, SLA definition, success and error quotas, request visualizations.
• DB monitoring, Serverless stack monitoring.
• Alerting of Production incidents so we can quickly resolve the issues on time.

Incentivized

• Complex attacks are identified frequently.
• Advanced thread intelligence.
• Privacy of all data is very well maintained.

• Tool is little hard to configure so need to be light to save resource consumption.
• Features are so in-depth that integrated guidance should be available to help the users on how to use.
• Graphical view can be improved to make it more convenient to understand the data representation.

Incentivized

• Alert windows cause lag in notifications (e.g. if the alert window is X errors in 1 hour, we won't get alerted until the end of the 1 hour range)
• I would appreciate more supportive examples for how to filter and view metrics in the explorer
• I would like a more clear interface for metrics that are missing in a time frame, rather than only showing tags/etc. for metrics that were collected within the currently viewed time frame

Incentivized

• False positives were identified frequently.
• Implementing rules are a very complex process.
• UI crashes were spotted randomly.
• Deployment needs to be much smoother.

Cisco Secure Network Analytics is a fantastic tool, but does require some setup and upkeep which may turn off smaller IT Security teams. However, once all the flows are set up and the product is functioning with the proper rules, the insight into your network is fantastic. For us, the product has a significant ROI and will be a product we keep up on.

Incentivized

Definitely will not revisit after our issues and, in my opinion, poor support.

Incentivized

Strong and complete tool which gives comprehensive methods to discover cyber security incidents and prevent data leakage. In case of common use of Cisco StealthWatch and Cisco ISE, you will receive [the] ability [to] not just discover cyber security incidents but also dynamically respond to them. This makes StealthWatch one of most valuable products through[out] [the] whole Cisco Security product portfolio.

Incentivized

There is some room for improvement, but the Datadog team sends out updates frequently, and the UI is user-friendly for engineers, with no significant loading issues or region-specific problems. That was one of the key reasons we preferred Datadog; our company has employees worldwide, and it wasn't difficult to transition to the tool.

Incentivized

We haven't had too many issues with the uptime and availability of CSNA, but the application does have a lot of dependancies and we have seen issues after an upgrade that caused an outage for several hours.

Incentivized

Overall winner because it exceeds our expectations by answering all our requirements and at the same time empowers our operations thru other built-in capabilities it has. Visibility is a key to security operations and Cisco StealthWatch really gives us a magnifying glass to check all logs in the network for threat intelligence and threat hunting.

The support team usually gets it right. We did have a rather complicate issue setting up monitoring on a domain controller. However, they are usually responsive and helpful over chat. The downside would be I don’t think they have any phone support. If that is important to you this might not be a good fit.

Incentivized

Implementation of the product can be tedious, especially fine tuning its rules to customize it to your environment. However, after that is done, CSNA is a very useful and flexible product that would enhance the security posture of any corporate network.

Incentivized

Documentation was difficult to work through, rollout was catastrophic (completely outage)

Incentivized

While other platforms such as Nagios and Solarwinds NTA provide visibility of the traffic, it either (*) does not provide API/programmatic way to pull the data to other platforms or (*) does not interface with secondary security systems to report on malicious traffic activity. Ultimately, these platforms accomplish the visibility, but do little else in the overall IT/security ecosystem of product, making them "dead end" data flow products where data goes in but does not share elsewhere.

Incentivized

Datadog is a more complex but complete solution than any of the other Log Aggregation, monitoring, or general observabilty tools that we have trialed. I found it easier to setup following useful and up-to-date documentation provided directly by Datadog instead of scattered around many blogs or articles. I would love to have my own Grafana + Prometheus expert to setup all the peices we need but you're paying for expertise there instead of an experience with Datadog.

Incentivized

• Once tuned and baselines established, it is far easier to identify issues on a network
• Management is able to look at the dashboard and fairly quickly get an update on the status of how the network is performing and what threats may be out there
• Reports can be scheduled to send on a regular basis to all involved with management of the infrastructure and the security team

Incentivized

• Saved us (time & money) from developing our own monitoring utilities that would pale in comparison
• Alerts allow us to remedy issues before our customers even know about them
• Tracking resource usage over time allows us to better plan for future needs, before it becomes a pain-point.

Incentivized

• Implementation did not go as planned. Therefore, time consumption was increased.
• Since we moved out of the tool, we had to consider another which costed time.