topic Re: Stealthwatch Proxy Ingestion License in Security Analytics

Stealthwatch Proxy Ingestion License

Aileron88 — Fri, 27 Dec 2019 10:43:27 GMT

Hi all,

Does the proxy ingestion license still exist in Stealthwatch or are the following licenses the only ones available now:

- Flow rate license

- Endpoint license

- PNM

- PCM

Thanks

Re: Stealthwatch Proxy Ingestion License

brford — Sat, 04 Jan 2020 16:54:40 GMT

What was the proxy ingest license is now included in the Stealthwatch license.

A Flow rate License is still needed.

An 'Endpoint License' is needed to process IPFIX from Stealthwatch Endpoint Concentrators. Those Endpoint Concentrators take in nzFlow from the Cisco AnyConnect NVM (Network Visibility Module) Agent (which is included with the AnyConnect Plus license). Note that nzFlow needs to be stitched into a connection for which NetFlow or IPFIX is available from a router, switch, or Flow Sensor and adds detail about connections that originate on that AnyConnect equipped client.

PNM (Private Network Monitoring) is a Stealthwatch Cloud license that is based on the number of devices being reported by a Stealthwatch Cloud Sensor.

PCM (Public Cloud Monitoring) is a. Stealthwatch Cloud license that is counted based on EMF (Effective Mega Flow); a measure of the data being reported by one or more public cloud (Azure, AWS, GCP) accounts to a Stealthwatch Cloud portal.

Re: Stealthwatch Proxy Ingestion License

deanilenko — Sat, 01 Aug 2020 12:02:58 GMT

@brford wrote:
What was the proxy ingest license is now included in the Stealthwatch license.

A Flow rate License is still needed.

An 'Endpoint License' is needed to process IPFIX from Stealthwatch Endpoint Concentrators. Those Endpoint Concentrators take in nzFlow from the Cisco AnyConnect NVM (Network Visibility Module) Agent (which is included with the AnyConnect Plus license). Note that nzFlow needs to be stitched into a connection for which NetFlow or IPFIX is available from a router, switch, or Flow Sensor and adds detail about connections that originate on that AnyConnect equipped client.

PNM (Private Network Monitoring) is a Stealthwatch Cloud license that is based on the number of devices being reported by a Stealthwatch Cloud Sensor.

PCM (Public Cloud Monitoring) is a. Stealthwatch Cloud license that is counted based on EMF (Effective Mega Flow); a measure of the data being reported by one or more public cloud (Azure, AWS, GCP) accounts to a Stealthwatch Cloud portal.

Hi Brford,

I am using SWE 7.1.2 and I do have base+flow rate licenses, but when I am trying to integrate my WSA with Flow Collector I am unable to do it, because of lack of license.

Are you sure about proxy license?

Re: Stealthwatch Proxy Ingestion License

sammausing — Tue, 18 Aug 2020 06:14:12 GMT

Recently I enabled ProxyWatch feature license on my SMC with TACs assistance. It appears under SMC>>Configuration>>licensing page after activation. Further configured my proxy servers on all Flow Collectors >>Configuration>>Proxy ingest.

Re: Stealthwatch Proxy Ingestion License

deanilenko — Tue, 18 Aug 2020 10:51:50 GMT

@sammausing wrote:
Recently I enabled ProxyWatch feature license on my SMC with TACs assistance. It appears under SMC>>Configuration>>licensing page after activation. Further configured my proxy servers on all Flow Collectors >>Configuration>>Proxy ingest.

Thank you for the info.

So, the TAC engineer activate ProxyWatch feature for you, but you did not purchase this feature additionally, correct?

Re: Stealthwatch Proxy Ingestion License

sammausing — Fri, 21 Aug 2020 02:22:27 GMT

Right! We did not purchased it.

Re: Stealthwatch Proxy Ingestion License

deanilenko — Fri, 21 Aug 2020 12:22:21 GMT

@sammausing wrote:
Right! We did not purchased it.

Thanks you for your help with this! You have pointed me into the right direction.

Indeed this feature is FREE now and anyone can use it, but you still have to have license for it. So, first of all you should go to the licensing team and ask them to issue a license for you and apply it in SMC. After that, you will be able to use this feature and do integrations with proxy.

This is how it works 🙂

Re: Stealthwatch Proxy Ingestion License

PeterCoffin41588 — Sun, 06 Sep 2020 19:56:03 GMT

Simply go to SMC>>Configuration>>licensing page. Make sure that you have activated it. Then after all go to Flow Collectors >>Configuration>>Proxy ingest. Hope your problem will be resolved.