Cisco Secure Network Analytics - .CSE Rule Exclude Payload information

aleksta9826435 — Wed, 02 Apr 2025 07:09:22 GMT

Hi everyone,

Having some .CSE rules when high amount of data Is leaving a internal network. Having alot of false positives related to this.
And I'm wondering If It's possible in some way to exclude a specifik "Subject Payload" field?

That "Subject Payload" Is visibile due to my SAL logging that I have.

From a regular "flow search" I can exclude the "Subject Payload" field under,
--> Advanced Connection Options
--> Payload

But this Is not available under,
--> Policy Management
--> Custome Security Events

Thanks

Re: Cisco Secure Network Analytics - .CSE Rule Exclude Payload informa

wajidhassan — Mon, 07 Jul 2025 16:39:51 GMT

It looks like you're hitting a limitation in Cisco Secure Network Analytics (StealthWatch/SAN)—custom security events (CSEs) don’t support filtering or excluding based on “Subject Payload”. That filter is only available in Flow Search, under Advanced Connection Options → Payload, but that same capability isn’t exposed in CSE creation under Policy Management.

🔍 What You Can Do Instead

1. Pre-filter with Flow Search + Scripted Alerting

Regularly run a scheduled Flow Search via API or CLI that includes Payload filters to exclude unwanted “Subject Payload” values.
Script processing of the results and generate alerts or write logs externally.
While this doesn’t use CSE, it allows fine-grained payload control.

2. Use Caller Context (Custom Fields)

In Flow Search, add payload filters to capture only desired events.
Export these events, then ingest them into your SIEM or Splunk, where you can alert or alert-categorize based on payload content.

3. File a Feature Request

Cisco docs and the community confirm this isn’t currently supported .
Consider submitting a feature request or POC to Cisco via TAC, asking to add payload filtering into CSE criteria.

⚠️ TL;DR

CSEs: can filter by host groups, bytes, packets, app, etc., but not by payload fields.
Flow Search: is payload-aware, but results aren’t alerting via CSE.
Workaround: Use scheduled Flow Search + scripting (or SIEM ingestion) to replicate what you want.