Cisco StealthWatch License

Cisco StealthWatch introduction

Cisco Stealthwatch observes network for any anomalies that maybe exists in the traffic, actually it does not analyze the packet itself and only packet headers are inspected and bypasses the encryption in the packet. As only the packet header is checked, Stealthwatch can inspect more traffic with consuming less CPU power.

When it comes to security, it must be Multi-layered and Cisco Stealthwatch is not a single security solution but should be part of a much bigger solution and networks should also utilize other tools such as Cisco NGFW FirePower.

Stealthwatch is installed as an additional appliance through network. Firewall still is being used to protect the network against external threats.

Basically, in the network, either Firewall or switch would send a layer 3 data to the Stealthwatch and suspicious traffic will be identified and Stealthwatch is going to raise an alarm and take action on the data.

The largest Stealthwatch system can analyze up to 600,000 flows per second from 10,000 devices. Also, it is re-scalable compared to other systems. Flows are a single conversation between two network devices. When a large file is going to upload on the network, it would be fragmented into multiple packets though it would still represent a single flow. The sending of a TCP FIN or a timeout symbolizes the end of conversation.

Reasons to Use Cisco Stealthwatch

• Stealthwatch is scalable and can process large volumes of traffic.
• Stealthwatch is not just for security purposes and it gives network administrators complete network visibility
• Network can be continuously monitored for which traffics has already bypassed NGFWs, furthermore, internal network will still be checked.
• Using Encrypted Traffic Analytics: traffic can also be checked to ensure is compliant with PCI and HIPPA

 Stealthwatch System Components

1. Stealthwatch Management Console

This is basically is the heart of the system and controls other features. The SMC analyses collected flow data from other components. Then it stablishes a baseline up to 7 days and any anomalies which are outside the baseline are reported and in addition alerts are raised for any threats and attacks that occur before and after the stablished baseline. The administrators can also run reports on the console to observe what has been done when and by whom. Moreover, custom policies can be made which can watch for any activities outside the compony policy. Patching and updating can be done via SMC. Finally, The SMC has the ability to be integrated to Cisco ISE and Microsoft Active Directory and this feature makes allows linking of users to alerts.

SMC Capacities and Requirements

• Stealthwatch Flow Collector

Initially Layer 3 network devices need to send flow data to Flow Collector and it processes the raw data and cleans it and organizes it. After that it sends the data to SMC to be analyzed and correlated with other flows.

• Stealthwatch Flow Sensor

Very similar to Flow Collector though Flow sensor can analyze layer 2 packets and frames sent between hosts. These sensors are connected to SPAN ports. SPAN is known as switch port analyzer that makes an exact copy of all frames that are either transmitted or received on a specified port or VLANs and will transmit them out of a SPAN port to an IDS sensor, a host running Wireshark or a Stealthwatch Flow Sensor. After that relevant data would be sent to SMC.

4. Stealthwatch UDP Director

UDP Director is responsible for two matter, first one is Data Aggregation which send collected data from multiple exporters as a single stream to FMC, Secondly, Flow sharing where flow data can be sent to multiple destinations such as SolarWinds, Cisco Prime and Cisco Stealthwatch.

Stealthwatch Data Storage

Advanced Features of Stealthwatch

Stealthwatch is not just a NetFlow analyzer is able to capture private and public addresses as some Public IP addresses might not be trustworthy and may be include Malware sites, command and control servers and ransomware servers. SMC checks each public address and for its trustworthiness and if an address points to a server that is a suspicious server it raises an alert.

Cisco Talos

Stealthwatch does not use the traditional methods to inspect threads like databases or pattern files instead it uses a service is called cisco Talos.

Cisco Talos is a threat intelligence group run by Cisco included full time researches, decoy systems and traps gather intelligence and updates a cloud-based database every 15 minutes for Cisco security devices to leverage for the purposes of attack mitigation.

Encrypted Traffic Analytics

As encryption is becoming more common now days, attackers also use encryption to avoid firewall inspection. Cisco have introduced encrypted traffic analytics (ETA) and this feature can detect threats in encrypted packets. Cisco Stealthwatch License is able to analyze ETA data. Currently Cisco Catalyst 9000 switches, ISR 1000 Router, ISR 4000 Router, CSR 1000v Cloud Router, ASR 1000 Router and Catalyst 9800 series wireless controller supports ETA technology.

Beyond Network Security

Cisco Stealthwatch License provides following powerful features:

• Monitoring Tools
• Stats are collected about utilization
• Congested links can be closely monitored
• Pinpoint nodes using excessive bandwidth
• Applications in use can be identified
  • QoS policies can be better tuned
  • Unauthorized application discovery
• Network Auditing Tools
  • Storing large amount of historical data
  • Contributes data towards forensic investigations

Cisco Stealthwatch Smart License

Cisco Stealthwatch Order Pricing

Cisco Stealthwatch Series try to enhance the of infrastructure and applications management in companies and corporate networks. It gives the access layer infrastructure to its trustworthy users. Indeed there are different ways to contact us and order. The customers should proceed from Cisco License price quote to order and link to our experts to give them the best information and guidance. Our experts give the accurate information to the customers to buy related products and licenses.