cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1345
Views
0
Helpful
6
Replies
Highlighted

Can stealthwatch show a HOST NAME next to the HOST ADDRESS (IP) ???

Hi Team,

 

Someone knows if is possible that stealthwatch show a HOST NAME next to the HOST ADDRESS (IP)

The users works fine between ise and LDAP, but i can´t see in Stealthwatch GUI the HOST NAME (LDAP).
I attach an example of the GUI as I see StealthWatch web dashboard.

 

Regards!

6 REPLIES 6
VIP Advocate RJI VIP Advocate
VIP Advocate

Re: Can stealthwatch show a HOST NAME (LDAP) next to the HOST ADDRESS (IP) ??? ise 2.1 - Stealthwatch 6.10.3

Hi,
So if you are using ISE are you doing 802.1x authentication? If so you can configure pxgrid integration between ISE and Stealthwatch, this will share the User/IP address mapping information and you should be able to achieve what you are looking for.

HTH

Re: Can stealthwatch show a HOST NAME next to the HOST ADDRESS (IP) ??? ise - Stealthwatch

Hello RJI,

Following this path in the dashboard _ MONITOR _ HOSTS  the dashboard, can "Host Name" show the user (LDAP) ??? or the information that shows "Host Name" is the name of the server ???

 

I attached an image for greater understanding

 

Thank you!

Regards!

Cisco Employee

Re: Can stealthwatch show a HOST NAME next to the HOST ADDRESS (IP) ??? ise - Stealthwatch

Hey Carlos,

I presume you're using Stealthwatch 7.0 from the picture, go to Stealthwatch Management Console, then to Central Management, choose SMC -> from Actions choose Edit Appliance Configuration for SMC -> within Appliance Configuration switch to Network Services -> then add on the right, manually the FQDNs of the host you want resolved in Local Resolution tab.

I added 2 snapshots for ease. Then you'll have the names resolved in Dashboard, specially in Host dashboard.

Cisco Employee

Re: Can stealthwatch show a HOST NAME (LDAP) next to the HOST ADDRESS (IP) ??? ise 2.1 - Stealthwatch 6.10.3

Carlos,

 

Have you configured your Stealthwatch Management Console (SMC) so that it can resolve using a local DNS?  If so (and if the local IP is listed in the local DNS DB) I believe that those network addresses should resolve to host names in the WebGUI.

 

I hope this helps.

 

Brian

Re: Can stealthwatch show a HOST NAME next to the HOST ADDRESS (IP) ??? ise - Stealthwatch

Hello  brford,

Following this path in the dashboard _ MONITOR _ HOSTS , can "Host Name" show the user (LDAP) ??? or the information that shows "Host Name" is the name of the server ???

 

I attached an image for greater understanding

 

Thank you!

Regards!

Cisco Employee

Re: Can stealthwatch show a HOST NAME (LDAP) next to the HOST ADDRESS (IP) ??? ise 2.1 - Stealthwatch 6.10.3

Hey Brian,

 

This is not working like this, I made sure both FlowCollectors and SMC can resolve the local FQDN of the servers, through the configured DNS server in SMC, even tested it on the SMC configuration page to make sure cache is corect, but in WebGUI the resolution does not happen, that is in my opinion wrong. SMC should try to resolve by itself the FQDN of the IPs, specially for the Server Host Groups. Or we should have an option in Host Group configuration where to mention if we ask SMC to do FQDN resolution or not for those host groups.

CreatePlease to create content
Content for Community-Ad
August's Community Spotlight Awards
This widget could not be displayed.