Providing IT Managers with data for network load/impact during security scans using Stealthwatch

ronjonjonjon1 — Tue, 11 May 2021 14:44:30 GMT

I work in an environment using Cisco Stealthwatch. We have a cybersecurity team that is doing an audit on our systems where they are scanning the network for vulnerabilities and other problems. I have to provide my management team with the outputted Stealthwatch results. I need to hone in on specific output.

Essentially, this team is just doing passive scans on our network. They are connecting Gigamon aggregators? and use Nessus to scan the network. They are just using laptops connected to the switch via an access port. I need to write up a report to management the network load their putting on the core switch. I know that their scanning is very low impact, but just need to verify that I am looking at the right tables/graphs to see the overall impact they are putting on the network.

Should I just use the Daily Report? Or is there some other output in Stealthwatch that I should be looking at that would provide more granular results. I know what ports the cyber team is connected to on the switch, but I don't believe I can actually look at data for those ports, just "index" correct?

Re: Providing IT Managers with data for network load/impact during security scans using Stealthwatch

dcavalla — Wed, 12 May 2021 09:11:10 GMT

Hello,

if the interface they are connected to is exporting netflow (possibly with NBAR) would such report help?

topic Providing IT Managers with data for network load/impact during security scans using Stealthwatch in Security Analytics

Providing IT Managers with data for network load/impact during security scans using Stealthwatch

Re: Providing IT Managers with data for network load/impact during security scans using Stealthwatch