Hello,
In the past SteatchWatch developed various features to ingest the logs from Proxy (using Proxy Ingest) or even sniff the URLs from the network (using Flow Sensor). This was before Cisco time. Can you share any recent news/features on adding third-party firewall support to StealthWatch? Or does Cisco is focusing on its own ecosystem in adding features for "Cisco Security Analytics and Logging"? I'm not asking about roadmap features, just the stuff already onboard in the product.
I have seen Check Point Netflow export configured and working with StealthWatch, but this only provides IP and Port details. The information from the URL and URL Filtering, Application Control, Identity Awareness was obviously missing in Netflow and StealthWatch.
With regards to ignoring third-party firewalls installed on the network, how much "stuff" can the Flow Sensor grab from the wire on a SPAN port? Obviously, without SSL/TLS inspection, it is impossible on the Span. But does it map the URLs to the web categories? Or is it fairly basic and not worth investing time in?
Regards, Serg.
