Item: Cisco Secure Network Analytics
Rating: 10
Author: Matt Frederickson

Overall Satisfaction with Lancope StealthWatch

Use Cases and Deployment Scope

We used this across the organization - 18 buildings spread across 72 square miles. It was used to identify and track Netflow data. It was originally purchased to answer two questions - what is happening on my network, and is it normal. Installation originally required two appliances, but by my third upgrade everything was 100% virtual.

Pros and Cons

Pros

Stellar at grabbing Netflow data - and really, really good at differentiating types of traffic.
Excellent at knowing which traffic was flowing from what endpoints - and then using some tie-ins to gather data about the endpoints.
Used this mostly for historic (what happened when) but also used it a few times for real-time analysis, looking for bandwidth hogs and help for troubleshooting issues.
Highly recommend as a forensic tool - doesn't do full packet capture, but for everything else it's awesome.

Cons

There is a slight learning curve with the UI - this could use some improvement. Once you learn though, it is not an obstacle.
Would like them to add a log correlation engine - that could tie into log files - but then it would be a SIEM.

Return on Investment

It is a little pricey - in my organization, with budget cuts, I eventually had to replace it with an open source product (NTOP). While it works well for visibility, it simply isn't the same. If you can afford it, don't bother looking anywhere else - just get it.
Being able to detect, pivot out, and remmediate from one console was awesome.

Alternatives Considered

NTOP is the only thing out there, in my opinion, that provides similar type of visibility. But StealthWatch is the product all vendors should strive to emulate. It is easy to install; it is easy to configure; it works as advertised (and then some). I do recommend the three-day work shop they occasionally run - or some onsite training. The product is feature rich and the training will help you get the most out of it.

Likelihood to Recommend

If you can't answer two questions - I mentioned them before - about your network, then you really are not in a good place from a cyber security or even customer service standpoint. Regardless if your networking is outsourced to a vendor, you need some type of check and balance - and you NEED to know what's going on.

I was able to use this product to detect a botnet on our network - and using the details, and the ability to tie in other software, pivot from the endpoint (in Stealthwatch) to another program which allowed me to completely remediate the botnet before it spread.

Comments

Please log in to join the conversation

Can You Answer Two Simple Questions - What's on Your Network and Is It Normal?