We are getting alarms related to the "UDP Received" security event. After checking the flows, it is Microsoft Teams traffic the one triggering the security event. Is it possible to turno of this security event for traffic using a specific set of port...
Welcome to the Security Analytics Board!
Please take a look at our Stealthwatch Information Hub and our Stealthwatch Use Cases.Forum Posts
When using Data Store, "alerts" are triggered, but there are many false positives.While "alarms" can be tuned using HostGroups and Policies, is there a way to tune "alerts"?
Hi,What is the best approach to collect flows for VM-to-VM traffic running in the same host and same port-group using standard VMware switches, (no distributed switches)?Regards.
Resolved! Adding Secondary NIC (Flow Sensor)
Hello.Could you tell me if it's possible to add a second network interface to the Flow Sensor virtual machine? It's been running for a while and connected to Manager.Simply adding a new interface in vCenter and then rebooting the VM didn't help. The ...
Resolved! Adding a flowSensor to an existing CSNA
Hello!We already have a working CSNA with three nodes: Manager, DataNode, and Flowcollector. They've been running for almost a year. Now we've decided to add a FlowSensor, but adding it throws an error. All our nodes are in the same subnet, including...
We are experiencing an issue with a Cisco Secure Network Analytics (SNA) Flow Collector (VE).Due to the expiration of a certificate, the Management Channel of a Flow Collector (VE) became unavailable and the system reported "Management Channel Down."...
Hi there,Currently i am testing the function "Naming and DNS" in the management section on my Manager VE node in Cisco Secure Network Analytics (formerly Stealthwatch)When i try to resolve a hostname I noticed it is only requesting the A, AAAA and MX...
Hi experts,Apologies for posting something that is not a QA topic, but I would like to humbly introduce a tool that may be useful for some of you.We have added support for Cisco Secure Network Analytics (SNA) to Network Sketcher, an OSS tool for crea...
Hello Team,In Anomaly Core Events, we can control events using the "When Host is Source" option. However, for "When Host is Target," the option is not available, meaning in anomaly category we can only control source host groups and not target host g...
Hi,I configured a CSE for alerting everytime a TLS connection using a version lower than 1.3 is made. I'm getting the flow alerts but I cannot see any URL information that helps me identifying which particular URL is not compliant. Is there any way t...
“Is it possible to export all default Relationship and Event policies from Cisco Secure Network Analytics into an Excel format?” Thank You.
https://youtu.be/WMGK8pn0YCYIn this session we discuss the difference of basic SIEM vs. SIEM centered on a data analytics platform first optimized with XDR. We discuss some of the existing challenges with basic SIEM and move towards optimizing data i...
can cisco secure network analytics use firewall syslog ingested from telemetry broker for analysis. and how can i configure SNA to receive syslog?
Resolved! Subject and Destination ports in flows
Hi,How does SNA classifies source and destination IP addresses and ports for flows? I've noticed port 80 as subject port and random high ports as destination, which for me, is a typical client to server communication but the subject and peer are exch...
Hello, Currently I am facing the following issue. I have a cisco flow collector and I successfuly I register it to the Stealthwatch SMC. I can see it from the central system manager but with the status "Data Store not Configured". If I click on th...
