Cisc Stealthwath RTC License consume

[ivan.martin]

Hi good afternoon

I should configure Cisco ISE RTC with Stealthwatch. I would like to know how should I use plus license (for pxgrid)?.

I have 1000 base license, my question If I only use Cisco RTC without profiling, Should I purchase only 100 or 1000 plus license?.

My  target is only use RTC no profiling.

Thannks you.

Best regards.  Ivan. 

[kyoshiik]

Yes, you need to purchase Plus license to use Rapid Threat Containment(RTC).

In RTC, this integration uses ANC policy, please check the below document:

https://ciscocustomer.lookbookhq.com/iseguidedjourney/Smart-License_Admin_Guide

And search "Device Administration Licenses" sections and Table1 is also helpful to understand ANC policy.

Plus is based on the number of concurrent endpoints with active network connections, so you need to select number to cover your environment. In your case, it should be less than 1000 because your base license is 1000.

[ivan.martin]

Thanks you for answer. Most of time we usually thinks when someone purchase base license and suddenly we need to add RTC services (without profiling policies) we have to purchase the same amount of license in both services (base and profiling)

According your advice it doesn't necessary this. Which should be the main reason to  choose the correctly amount of plus license to use RTC service.? Perhaps can we use 100 plus license?

Best regards Ivan.

[kyoshiik]

I confirm this to the internal resources.

Answer is 1:1 = Base:Plus.

You need to purchase 1000 Plus license.