Hi,I have a question:Does CISCO ASR is able to support a peer that has node which has end entity Certificate based on ECDSA ciphers but signed with CA certificate based on RSA ciphers? I am using ASR1006 with Cisco IOS XE Software, Version 16.06.03.B...
Welcome to the Security Analytics Board!
Please take a look at our Stealthwatch Information Hub and our Stealthwatch Use Cases.Forum Posts
hi experts, i have a little problembecause some client has stealthwatch and want to integrate it with ADthe integration is fine from i stealthwatch(we are using the same user type that we use for ISE to get data from the same AD) following this docum...
Hi, I am new to Stealthwatch and have some questions which I cannot find in the other discussions in the community forum. We have a small deployment at one of our customers with 1 SMC and 1 FC. It is a multi-vendor environment. We have cisco, palo al...
Resolved! Firepower YARA rules
How i can deploy YARA rules by firepower
Resolved! ETA Analytics
If a infrastructure device (router, switch) is capable and enabled for Encrypted Traffic Analysis - will east/west traffic within an environment be reported on? It was my understanding that ETA was specifically for traffic between the Inside and Outs...
Hi Guys We've recently updated to Stealthwatch v7.1.2 are we're currently trying to activate the CTR integration using the below guide. https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/ctr/SW_7_1_2_Stealthwatch_and_Threat_Response_Inte...
We just got a new FlowCollector and we reconfigured a few exporters to send Netflow data to the new FlowCollectoris there a way to move the data collected to the new flow collector ? or delete all of them for that Flowcollector in batches instead of ...
Hi Team I trying configure StealthWatch Failure on Two SMC Primary and secondary, I follow all steps under the Online help tool.I have Trial License full, and start Failure mode by Seconday SMC: Both SMC* Have Trial License OK I start Failure test un...
Hi,I am not a true licensing guru when it comes to stealthwatch. I know up to 250 exporters that will be close to 4,500 flows per second. But is there a true calculator out there where you can plug in the number of switches/exporters to determine the...
Hello everyone, We will be forwarding ISE logs to our SEIM (Helix) I wanted to know what are the top 5-10 logs I should be alerting on? I need to put together an action plan so I cant do that for all the logs. Thankssecurity, Stealthwatch
Good Day Everyone I am currently preparing for a Greenfields Stealthwatch deployment at a customer.I had a look at the documentation and seems like version 7.2 is the latest and has some nice changes from 7.1. But when I get to Cisco Software Central...
Hello all, I want to ask,we can see the storage statistics in the Appliance Flow Collector menu, there is visible capacity in days, remainin days, bytes per day, I have also confirmed to the TAC that the data can be a reference / estimate when the st...
hi experts, hope you are doing wellwe have stealthwatch working fine, but in sometimes we stop receiveing flows in the flow collectorafter capturing traffic, i see cflow packets, but it shows like malformed, what could be the reason to this?and a hea...
A simple portscan was initiated from a Linux host scanning a /24 subnet for ports 14021-14025/tcp.SMC displayed correct number of flow records in flow table for this activity but "Total Traffic" and "Total Bytes" column was empty for all the flows. A...
Is there any documentation for using the "additional BPF" field from packet capture utility on Stealthwatch Flow Collector.Trying to find out are there any examples or syntax on how to use this field.TIA
