How can CESA detect users using VPNs other than Cisco AnyConnect? Please let us know how to filter. I mean, want to identify users who use free VPN (Stray VPN) and their VPN products. Thank you in advance.
Welcome to the Security Analytics Board!
Please take a look at our Stealthwatch Information Hub and our Stealthwatch Use Cases.Forum Posts
Hello, I have installed SNA 7.4 without data store. I have only SMC and FC. When I try to open Alerts or Analytics page I get redirected to Data Store page. Where can I enable Alerts and Analytics pages? Thanks in advance
Hello! We're interested in having a visual representation of the number of connections within a specific subnet. Specifically, if we search for a subnet, such as 192.168.1.0/24, our goal is to have a diagram or chart that illustrates all the hosts wi...
Hai Cisco secure workload data sheets and documents show conflicting info, in one place it's mentioned starting from the 2021 vm version cannot be used in production but can be used as proof of value only.Can someone clarify this and what are the ser...
Resolved! Stealthwatch CA Idendity Certificate
Hi all,I have a problem when I try to update the identity certificate of the Manager to a custom one of my own CA.When I update it, I loose the connection to the appliance and I get "Config Channel Down" And according to the documentation, I should ...
Hi all, I am currently using cisco SAL, and I am wondering how to include the sensitive subnets that has been scanned to email alerts that are sent out to the existing users. It is too brief and inefficient, I would need to go into the web app to see...
Hi Experts, I got a question ! If we have sltealthwatch configured with CTA which can get us C&C flow. Now do we really require SLIC feature? Regards, Jay
Hello Team, I have a Cisco SNA deployment which is running on 7.4.0, now when the event trafficlogs are forwarded to any of the syslog or siem servers example IBMQradar / Syslog-ng i see the destination ip address coming as 0.0.0.0 which is kind of n...
Stealthwatch flow duration time declare the sesion establishment timing for perticular source ip to destination ip and service.If the connection will stop for 5 min stealthwatch will show the session is stoped and show the time accordingly in flow du...
We have a "Exfiltration" alarm that triggers between several source hosts and a single target host. For example, I've created a host group A for the source hosts and host group B for the target hosts.How can I stop the "Exfiltration" alarm from trigg...
Hi there, Recently I integrated CISCO identity service engine 3.0.0.458 with stealth watch 7.3.0, the Active directory service are enabled & I get to see the users in monitor section of stealth watch management center , when i open the user for bet...
Hi,1. how can I clear non active allarms manually?2. how can I acknowledge allarms manually?
How can I exclude or change Virtual-Access? There are dynamically tunnels and I can't set bandwidth
Hello, Does anybody know if are there any way to receive a message on SCA when a Sensor came back online after being down. Thanks
Hello, When I'm trying to send post (for example add host group) to SNA 7.4.1 API, I received 401 unauthorized error. All get requests are fine. Authentication is passed and cookies are the correct one when I tried to post. Is there something I shoul...
