https://community.cisco.com/t5/security-analytics/stealthwatch-security-analytics-sensor-question/m-p/4563167#M766 <P><STRONG>Question</STRONG>: What's the fastest way to determine which sensor reports an observation or alert in Stealthwatch?<BR /><BR /><STRONG>Challenge</STRONG>: I have multiple sites with Cisco FTD firewalls, managed by CDO. I also have several ONA sensors deployed throughout a global network. When I see an alert in Stealthwatch, the observation is informational, but I don't see an obvious way to determine <STRONG>what sensor</STRONG> reported the issue or observation. The closest I've found to this is to pre-determine subnets, but that doesn't stop a rogue intruder from connecting to a network device and spinning up a new VLAN or sub-interface (assuming my security was weak).<BR /><BR />Any ideas? Thanks!</P> Thu, 03 Mar 2022 16:17:51 GMT bmurphree@myemma.com 2022-03-03T16:17:51Z https://community.cisco.com/t5/security-analytics/stealthwatch-security-analytics-sensor-question/m-p/4563167#M766 <P><STRONG>Question</STRONG>: What's the fastest way to determine which sensor reports an observation or alert in Stealthwatch?<BR /><BR /><STRONG>Challenge</STRONG>: I have multiple sites with Cisco FTD firewalls, managed by CDO. I also have several ONA sensors deployed throughout a global network. When I see an alert in Stealthwatch, the observation is informational, but I don't see an obvious way to determine <STRONG>what sensor</STRONG> reported the issue or observation. The closest I've found to this is to pre-determine subnets, but that doesn't stop a rogue intruder from connecting to a network device and spinning up a new VLAN or sub-interface (assuming my security was weak).<BR /><BR />Any ideas? Thanks!</P> Thu, 03 Mar 2022 16:17:51 GMT https://community.cisco.com/t5/security-analytics/stealthwatch-security-analytics-sensor-question/m-p/4563167#M766 bmurphree@myemma.com 2022-03-03T16:17:51Z https://community.cisco.com/t5/security-analytics/stealthwatch-security-analytics-sensor-question/m-p/4731011#M891 <P>Hello - Sorry this took so long to answer - I just recently got assigned to SCA.&nbsp;&nbsp;</P> <P>You can tell which sensor uploaded the information here:&nbsp; From Monitoring &gt; Observations &gt; Select the Dropdown next to the 'Time' of the observation and select 'Session Traffic &gt; This brings up the session traffic, scroll window to the far right for the 'Sensor' column.&nbsp; &nbsp; You should see the name of the sensor that uploaded the information.</P> <P>&nbsp;&nbsp;</P> Thu, 01 Dec 2022 15:23:03 GMT https://community.cisco.com/t5/security-analytics/stealthwatch-security-analytics-sensor-question/m-p/4731011#M891 rocedar 2022-12-01T15:23:03Z