Hi everyone,Having some .CSE rules when high amount of data Is leaving a internal network. Having alot of false positives related to this. And I'm wondering If It's possible in some way to exclude a specifik "Subject Payload" field?That "Subject Payl...
Welcome to the Security Analytics Board!
Please take a look at our Stealthwatch Information Hub and our Stealthwatch Use Cases.Forum Posts
Hi,Analyzing the TrustSec Policy Analytics report generated by Secure Network Analytics, we can see offending traffic taking place between SGTs that have a deny ip SGACL applied, so in priniciple this traffic is not taking place since it is being enf...
It seems that when the ESA interrupts the e-mail for "borted due to size limit exceeded" on the tracking we see message size : na, we would like to know if it is possible to make it possible to see the size of the e-mail that was aborted?
How can I search for newer software versions in the Cisco Vulnerability Repository,or how should I read the information in the Cisco Vulnerability Repository? In the Cisco Vulnerability Repository, I can check for vulnerabilities for specific softwar...
Hi,When I try to run a packet capture on the FC GUI I get this message "Log in to your Manager, and follow the instructions in the Help to generate a packet capture. " If I go to that resource I see a bunch of CLI examples that are no longer usefull ...
Hi,We have two SNA Netflow collectors and we have configured a Data Flow that sends all the flows to one of the collectors only to avoid duplicates. Is it possible to automatically do a failover in case the active collector fails? Thanks
Anyone knows the Secure Malware analytics (ThreatGrid) cloud license can be applied in SMA M6 hardware appliance. Attaching screenshot below;
Hi,We are running a SDA fabric with Trustsec-based enforcement and SGT in place. Our edge nodes generate logs for all the traffic blocked by the TrustSec matrix. Those logs contain src and dst IP + port information. Is it possible to ingest those log...
I am installing virtual SMC, FS, and FC. SMC and FC is already running but I encounter the same error. I am assuming its related to time sync since the error happens after it apply settings on the ntp server. On the FC, I did not do anything and just...
I try to replace appliance identity certificate Generated CSR for Manager Generated CSR for Collector Sent them to OUR CA (DC) (admins did template follow this guide https://dependencyhell.net/2021/securing-stealthwatch-with-ca-signed-certificates) ...
Hi, doing some investigation into Stealthwatch...setting this up in my lab with Data Store option. Mgmt server sent through okay but as I went threw the data store initialization at the console, it asks at the end to register with central manager. I...
After upgrading to version 7.5.1 Cisco Security Network Analytics client isn't working. I enter the Ip address of the sms server andthe window stops at this point:
Hi allExperiencing Issues with creating Custom Security Events towards NVM (nvzflows) In my SNA platform.Been creating a test Custom Security Event, just to see If it triggers."CSE: Forbidden Application"When any subject host; using the process "well...
HelloIs everyone here having experience with the NVM-module, that Is possible to have within the Secure Client?How does SNA handles large amount of NVM-flows? Lets say between 5K -> 10K clients.Ideally Is It worth setting up a dedicated Flow Collecto...
how to migrate cisco stealthwatch to new secure network analytics (SNA) hardware?Which is the latest stable version for SNA now?
