Cisco Secure Network Analytics (Stealthwatch)

StealthWatch is currently being used to analyze NetFlow in our organization. This gives us important insight into what kinds of traffic is going through our network devices and allows us to provide this information to other departments in a much easier and digestible way than before. We have used it to help other departments in their decision making and analytics.

Cisco Secure Network Analytics allows you to see everything on your network, whether it is wired or wireless. This is truly critical in security and it helps see what devices are doing, especially the ones that you cannot install an agent on. With its strong integrations we are able to provide a complete picture of what a device is and what it is doing on the network.

Cisco Secure Network Analytics with its Stealthwatch technology has the ability to raise any organization’s defence by giving detailed notice of visibility while providing security analytics. Access is provided to the organization to keep an eye on each and every host. It records every conversation while knowing any abnormality. It sends alerts to check the threats quickly. By using this tool, an organization can easily increase its security and it has facilitated us in acknowledging what is going on with the organization’s network. It is helpful for us keeping record of Netflow data as well.

Cisco Secure Network Analytics (Stealthwatch) is being used as a monitoring tool for IT--specifically by IT security to be alerted when Cisco Secure Network Analytics (Stealthwatch) "thinks" things should be checked. It checks for nefarious events or events that are not normal to the normal workplace environment. Cisco Secure Network Analytics (Stealthwatch) has been setup to watch for anomalies on the network and then to alert IT. It was originally installed to quell an audit report that found a deficiency in our IT security and to help prevent new issues and to also possibly help discover where they may have originated on the network.

We got access to Stealthwatch with our Cisco Umbrella. We went with the on-premise version of Stealthwatch and like the product. We're sending in DNS, VPC Flow logs, etc and like how it pulls that and processes it and really cleans up the noise. Currently looking to get it fully-integrated with our SIEM.

The business problem which StealthWatch solves is visibility of the network traffic. Analyzing of flow (whether it is NetFlow or sFlow or IPfix) is very handy when it comes to troubleshooting, but StealthWatch extends usability of flow protocol beyond network operations. It gives possibility to use flow protocols data in cyber security domain to discover cyber security incidents by analyzing of network traffic behavior anomalies.

This is used in the whole organization, which consists of multiple offices amongst several regions from EMEA, APAC, & CONUS. We highly rely on Cisco StealthWatch to identify and track what is going on in our corporate network and prevent possible breaches as well as remedy existing ones, if any.

Cisco StealthWatch is primarily used by my organization for security incident response, forensic, monitoring, analysis, and even for our threat hunting. It provides us centralized knowledge in our Security Operations field. It is being used across the whole organization. It addresses the following business problems that we have:
1. Regulatory requirements.
2. Simplifies network security, analysis, and monitoring.
3. Less reconfiguration to existing deployments or assets.

We used this across the organization - 18 buildings spread across 72 square miles. It was used to identify and track Netflow data. It was originally purchased to answer two questions - what is happening on my network, and is it normal. Installation originally required two appliances, but by my third upgrade everything was 100% virtual.