Security Analytics

Hi there,Currently i am testing the function "Naming and DNS" in the management section on my Manager VE node in Cisco Secure Network Analytics (formerly Stealthwatch)When i try to resolve a hostname I noticed it is only requesting the A, AAAA and MX...

Hi experts,Apologies for posting something that is not a QA topic, but I would like to humbly introduce a tool that may be useful for some of you.We have added support for Cisco Secure Network Analytics (SNA) to Network Sketcher, an OSS tool for crea...

Hello Team,In Anomaly Core Events, we can control events using the "When Host is Source" option. However, for "When Host is Target," the option is not available, meaning in anomaly category we can only control source host groups and not target host g...

When using Data Store, "alerts" are triggered, but there are many false positives.While "alarms" can be tuned using HostGroups and Policies, is there a way to tune "alerts"?

We are getting alarms related to the "UDP Received" security event. After checking the flows, it is Microsoft Teams traffic the one triggering the security event. Is it possible to turno of this security event for traffic using a specific set of port...

Hi,I configured a CSE for alerting everytime a TLS connection using a version lower than 1.3 is made. I'm getting the flow alerts but I cannot see any URL information that helps me identifying which particular URL is not compliant. Is there any way t...

“Is it possible to export all default Relationship and Event policies from Cisco Secure Network Analytics into an Excel format?” Thank You.

https://youtu.be/WMGK8pn0YCYIn this session we discuss the difference of basic SIEM vs. SIEM centered on a data analytics platform first optimized with XDR. We discuss some of the existing challenges with basic SIEM and move towards optimizing data i...

can cisco secure network analytics use firewall syslog ingested from telemetry broker for analysis. and how can i configure SNA to receive syslog?

Hello,    Currently I am facing the following issue. I have a cisco flow collector and I successfuly I register it to the Stealthwatch SMC. I can see it from the central system manager but with the status "Data Store not Configured". If I click on th...

I need to use on-prem SAL to increase FMC events retention on SNA and need to provide high availability between two data centers for my deployment. i also have have cisco telemetry broker. Would it be the same if 1- i configured ftd syslog to point t...

Today I made transition to flow collector with datastore.Since then I get major alarms "FlowCollector Longest Export Exceeded after transition to datastore" every hour from different network devices.Why does this appear after transition to datastore?

I had 5 flow collectors (VMs)vCPU - 12Memory - 128GbHDD - 3.6TbI decided to add 3 data node to use Data StorevCPU - 18Memory - 64GbHDD - 18TbAnd after it one of my collector started to sent message FlowCollector Performance Degraded - OversubscribedI...