Security Analytics

We have an instance of a VFTD firewall on our infrastructure and we would like to monitor it's sessions that are coming to our network via snmp but we couldn't find any OIDs related to that . 

Hi, One of our customer has purchased VM editions of SMC, FC and FS appliances and 25000 flows licenses. We found that we have different models of VM appliances like SMCVE, SMC2000VE and FCVE,FCVE2000. I found that these specs are based on the host c...

Good Day I recently enabled syslogs from a bluecoat proxy into Stealthwatch.I can see some URL data for users so on the surface it does seem good.I did notice in the log file though some errors. FC01:~# tail -f /lancope/var/sw-flow-proxyparser/logs/s...

Things appeared to go sideways yesterday (02/10) with regard to the data in the SLIC feed - as we received 40+ alerts of C&C activity as users were browsing to www.google.com - the destination IPs were what is expected for Google The destination C&C ...

Hi Team,I have installed Host Classifier application v1.0.13 on SMC v7.0.3, but it is not populating any data on App dashboard as it could not find pre-defined host groups. Does this app needs manual creation of host groups. Thanks.

(this might mean that someone trying to fool you or steal any info you send to the server)the above message appeared on the client side when using FTD decrypt-resigned, is there any one can help solving that issue . 

I just inherited Stealthwatch 6.10.5 all on VM which includes one of each of the following: smc, flow, udp.  I now need to renew/update the existing certificates that were installed.  I have renewed the existing certificates and have all three in a ....

My ASA has numerous site to site VPNs connected to it.  I am trying to log the connections made from the inside network to remote VPN site subnets.  ACLs, as typical are bypassed for site to site vpns, so creating ACLs with logging preference are not...

Is there any documentation or has anyone configured Netflow/Sflow on F5 BIG-IP LTM to send flows to Stealthwatch.

Hi, is there a way to reset the Interface Status under Interfaces- Monitor in Stealthwatch 7.1.2?Currently seeing "Interface Status (Since Reset Hour)" - not sure what this means..Thanks,