Hi, I am trying to run stealthwatch API to get the security events from Python sample script (https://developer.cisco.com/docs/stealthwatch/enterprise/#!quick-start) however I am getting 400 errors. python3 get_security_events.py An error has occurre...
Welcome to the Security Analytics Board!
Please take a look at our Stealthwatch Information Hub and our Stealthwatch Use Cases.Forum Posts
Hi,#I am looking to complete a new replacement stealthwatch deployment. The aim is to use a higher version 7.4 instead of 7.0 but essentially be configured exactly the same way.Am I able to setup the new stealthwatch on version on 7.4 and configure f...
Resolved! Stealthwatch Flow Sensor high CPU usage
Hi guys, The FS is capturing the traffic from the Switch with the help of the SPAN protocol. Few CPU cores show the CPU utilization close to 90%. This usage is in the range of 82%-90% always. So I just want to know if is this normal behavior or if I ...
Resolved! SNA Stealthwatch SLIC channel down
Hi all,I'm new in the communinty, thanks in advance for any help you'd like to provide me.My customer is using Secure Network Analytics version 7.4.2, the product have been licensed, also the license for Threat Intelligence is authorized but the alar...
Hello, I've run into an issue with authenticating the SecureX Security Ribbon in Secure Network Analytics.I also noticed this new API Client in my SecureX environment and I'm unaware of how to approve it.Thanks!
How can CESA detect users using VPNs other than Cisco AnyConnect? Please let us know how to filter. I mean, want to identify users who use free VPN (Stray VPN) and their VPN products. Thank you in advance.
Hello, I have installed SNA 7.4 without data store. I have only SMC and FC. When I try to open Alerts or Analytics page I get redirected to Data Store page. Where can I enable Alerts and Analytics pages? Thanks in advance
Hello! We're interested in having a visual representation of the number of connections within a specific subnet. Specifically, if we search for a subnet, such as 192.168.1.0/24, our goal is to have a diagram or chart that illustrates all the hosts wi...
Hai Cisco secure workload data sheets and documents show conflicting info, in one place it's mentioned starting from the 2021 vm version cannot be used in production but can be used as proof of value only.Can someone clarify this and what are the ser...
Resolved! Stealthwatch CA Idendity Certificate
Hi all,I have a problem when I try to update the identity certificate of the Manager to a custom one of my own CA.When I update it, I loose the connection to the appliance and I get "Config Channel Down" And according to the documentation, I should ...
Hi all, I am currently using cisco SAL, and I am wondering how to include the sensitive subnets that has been scanned to email alerts that are sent out to the existing users. It is too brief and inefficient, I would need to go into the web app to see...
Hi Experts, I got a question ! If we have sltealthwatch configured with CTA which can get us C&C flow. Now do we really require SLIC feature? Regards, Jay
Hello Team, I have a Cisco SNA deployment which is running on 7.4.0, now when the event trafficlogs are forwarded to any of the syslog or siem servers example IBMQradar / Syslog-ng i see the destination ip address coming as 0.0.0.0 which is kind of n...
Stealthwatch flow duration time declare the sesion establishment timing for perticular source ip to destination ip and service.If the connection will stop for 5 min stealthwatch will show the session is stoped and show the time accordingly in flow du...
We have a "Exfiltration" alarm that triggers between several source hosts and a single target host. For example, I've created a host group A for the source hosts and host group B for the target hosts.How can I stop the "Exfiltration" alarm from trigg...
