I have a number of devices that send telemetry to Microsoft. These devices are triggering High File Sharing Index alert. I've managed to filter down the MS telemetry IP ranges and put them in a host group but can't filter the alarm. When can select...
Welcome to the Security Analytics Board!
Please take a look at our Stealthwatch Information Hub and our Stealthwatch Use Cases.Forum Posts
Title: Seeking Insights: Essential Cybersecurity Practices in the AI EraHello Cisco Community,As artificial intelligence continues to transform the technology landscape, it is also reshaping the cybersecurity threat landscape. Organizations are incr...
Hello, We are facing an issue while registering the Data Store appliance to the Cisco Secure Network Analytics (CSNA) Manager (formerly Stealthwatch), version 7.5.2. During the setup process, the registration fails with the following message: "We cou...
We are getting alarms related to the "UDP Received" security event. After checking the flows, it is Microsoft Teams traffic the one triggering the security event. Is it possible to turno of this security event for traffic using a specific set of port...
When using Data Store, "alerts" are triggered, but there are many false positives.While "alarms" can be tuned using HostGroups and Policies, is there a way to tune "alerts"?
Hi,What is the best approach to collect flows for VM-to-VM traffic running in the same host and same port-group using standard VMware switches, (no distributed switches)?Regards.
Resolved! Adding Secondary NIC (Flow Sensor)
Hello.Could you tell me if it's possible to add a second network interface to the Flow Sensor virtual machine? It's been running for a while and connected to Manager.Simply adding a new interface in vCenter and then rebooting the VM didn't help. The ...
Resolved! Adding a flowSensor to an existing CSNA
Hello!We already have a working CSNA with three nodes: Manager, DataNode, and Flowcollector. They've been running for almost a year. Now we've decided to add a FlowSensor, but adding it throws an error. All our nodes are in the same subnet, including...
We are experiencing an issue with a Cisco Secure Network Analytics (SNA) Flow Collector (VE).Due to the expiration of a certificate, the Management Channel of a Flow Collector (VE) became unavailable and the system reported "Management Channel Down."...
Hi there,Currently i am testing the function "Naming and DNS" in the management section on my Manager VE node in Cisco Secure Network Analytics (formerly Stealthwatch)When i try to resolve a hostname I noticed it is only requesting the A, AAAA and MX...
Hi experts,Apologies for posting something that is not a QA topic, but I would like to humbly introduce a tool that may be useful for some of you.We have added support for Cisco Secure Network Analytics (SNA) to Network Sketcher, an OSS tool for crea...
Hello Team,In Anomaly Core Events, we can control events using the "When Host is Source" option. However, for "When Host is Target," the option is not available, meaning in anomaly category we can only control source host groups and not target host g...
Hi,I configured a CSE for alerting everytime a TLS connection using a version lower than 1.3 is made. I'm getting the flow alerts but I cannot see any URL information that helps me identifying which particular URL is not compliant. Is there any way t...
“Is it possible to export all default Relationship and Event policies from Cisco Secure Network Analytics into an Excel format?” Thank You.
https://youtu.be/WMGK8pn0YCYIn this session we discuss the difference of basic SIEM vs. SIEM centered on a data analytics platform first optimized with XDR. We discuss some of the existing challenges with basic SIEM and move towards optimizing data i...
