topic Stealthwatch Backups in Security Analytics

Stealthwatch Backups

dm2020 — Tue, 11 Feb 2020 18:24:30 GMT

Hi All,

I'm looking at configuring the database backup for Stealthwatch. I have managed to configure and establish a connection to an SMB share, however, when I click on 'Create Backup' Stealthwatch immediately backs up and there doesn't seem to be an option to set a schedule. I've tried looking for the backup configuration in the user guides but its very limited.

How can a scheduled backup be configured?

Re: Stealthwatch Backups

kyoshiik — Thu, 13 Feb 2020 05:28:08 GMT

Sorry, only manual backup is possible.

Re: Stealthwatch Backups

dm2020 — Thu, 13 Feb 2020 10:32:51 GMT

Thank you for the response.

If thats the case, do we need to manually backup the database only on the SMC or do we need to do this for the other devices as well such as on the FCs?

Re: Stealthwatch Backups

kyoshiik — Thu, 13 Feb 2020 12:22:58 GMT

In backup scenario, the most important is FlowData and next one is host group configuration in Stealthwatch products. FlowData is stored in FC and host group configuration are in FC. So both are important for normal environment. FlowData can’t restored once it broken without back up. Host group configuration needs many time to recover without backup. Of course SMC back up is also important.

Re: Stealthwatch Backups

kyoshiik — Thu, 13 Feb 2020 12:26:35 GMT

If you are interested in another scenario of FlowData backup, please check below thread. Stealthwatch has an API to export FlowData from FC to 3rd party products such as SIEM.

https://community.cisco.com/t5/security-analytics/forwarding-ipfix-flows-from-flow-sensor-to-third-party-device/td-p/4015905

Re: Stealthwatch Backups

Ken Stieers — Thu, 05 Mar 2020 18:50:55 GMT

@kyoshiik wrote:
. Of course SMC back up is also important.

Maybe we don't think Stealthwatch believes this is so because they don't treat it as important.

We should be able to schedule it

We should be able to send it to a box that has SMB1 OFF...

Re: Stealthwatch Backups

kyoshiik — Fri, 06 Mar 2020 08:12:13 GMT

I’ll check scheduled back up option in future update and let you know.

Re: Stealthwatch Backups

kyoshiik — Fri, 06 Mar 2020 09:01:42 GMT

I checked roadmap and there is no plan for this now. I’ll add feature request.