topic Re: Stealthwatch Backup on some other server in Security Analytics

Stealthwatch Backup on some other server

GauravGupta0286 — Fri, 28 May 2021 14:13:55 GMT

HI Team

I wanted to know how to setup a backup of all Stealthwatch devices on third party server what is the best way to do it i dont have test bed environemnt so solution should be well tested

Re: Stealthwatch Backup on some other server

Marvin Rhoads — Sat, 29 May 2021 08:00:54 GMT

Are you using Stealthwatch hardware appliances or VMs?

Re: Stealthwatch Backup on some other server

GauravGupta0286 — Mon, 31 May 2021 06:50:16 GMT

HI Marvin

I have all Stealthwatch as Hardware appliance 2210 flow collector flow sensor

Re: Stealthwatch Backup on some other server

Marvin Rhoads — Mon, 31 May 2021 12:12:07 GMT

Each appliance automatically saves a copy of its configuration backup on a daily schedule to local disk for 30 days. This can be helpful if an administrator makes a configuration error such as deleting the host group tree, or some other misconfiguration occurs. The backups saved on the appliance can be used to return the box to a working configuration if the issue is found within 30 days. However, if the appliance fails or is reset to factory defaults then the locally saved configuration backups will not be available. Saving a configuration backup to an external machine is critical.

To save backups to your external machine, use the following procedure, starting with your SMC and then followed by your Flow Collectors(s), Flow Sensor(s) and and UDP Director(s):

1. Click the Support menu and select the Backup/Restore Configuration menu item (not the Database option!)

2. You will see a list of previously saved backups that exist on the appliance itself from its daily configuration backup. Create a backup on demand by clicking the Create Backup button

3. Once the backup has been created, click the Download button.

4. The configuration backup will be downloaded by the web browser and saved in the Downloads folder.

5. Repeat the steps for all remaining appliances.

Re: Stealthwatch Backup on some other server

GauravGupta0286 — Mon, 31 May 2021 13:19:28 GMT

HI Marvin

Thanks for the suggestion however i dont need a manual intervention of the above steps i am looking for a solution where the above task of downloading should be done automatically without a human intervention.

Re: Stealthwatch Backup on some other server

Marvin Rhoads — Mon, 31 May 2021 14:43:06 GMT

Unfortunately such a feature is not currently available as of the latest release (currently 7.3.2).

Re: Stealthwatch Backup on some other server

GauravGupta0286 — Mon, 31 May 2021 14:49:26 GMT

Surprise to see your answer i was reading the below document and want to implement something like this however i need confirmation if this is tried and tested solution as my device is in production and dont want to break something.

CiscoSE/stealthwatch-config-backup: Stealthwatch Enterprise Config Backup Script

Re: Stealthwatch Backup on some other server

Marvin Rhoads — Mon, 31 May 2021 15:03:10 GMT

The solution you linked to is an external script that logs into the SMC and copies the files off to a place of your choosing. That's possible with almost any product that can be logged into remotely. It is not a feature of the Stealthwatch / Cisco Secure Network Analytics product.

While it "should" work, it is as noted in the disclaimer on the page (emphasis added):

"Cisco provides DevNet Code Exchange for convenience and informational purposes only, with no support of any kind. This page contains information and links from third party websites such as GitHub that are governed by their own separate terms. Reference to a project or contributor on this page does not imply any affiliation with or endorsement by Cisco."