cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3659
Views
0
Helpful
7
Replies

Stealthwatch Backups

dm2020
Level 1
Level 1

Hi All,

 

I'm looking at configuring the database backup for Stealthwatch. I have managed to configure and establish a connection to an SMB share, however, when I click on 'Create Backup' Stealthwatch immediately backs up and there doesn't seem to be an option to set a schedule. I've tried looking for the backup configuration in the user guides but its very limited.

 

How can a scheduled backup be configured?

 

 

7 Replies 7

kyoshiik
Cisco Employee
Cisco Employee

Sorry, only manual backup is possible.

Thank you for the response.

 

If thats the case, do we need to manually backup the database only on the SMC or do we need to do this for the other devices as well such as on the FCs?

In backup scenario, the most important is FlowData and next one is host group configuration in Stealthwatch products. FlowData is stored in FC and host group configuration are in FC. So both are important for normal environment. FlowData can’t restored once it broken without back up. Host group configuration needs many time to recover without backup. Of course SMC back up is also important.


@kyoshiik wrote:

. Of course SMC back up is also important.


Maybe we don't think Stealthwatch believes this is so because they don't treat it as important.

We should be able to schedule it

We should be able to send it to a box that has SMB1 OFF... 

 

I’ll check scheduled back up option in future update and let you know.

I checked roadmap and there is no plan for this now. I’ll add feature request.

If you are interested in another scenario of FlowData backup, please check below thread. Stealthwatch has an API to export FlowData from FC to 3rd party products such as SIEM.

 

https://community.cisco.com/t5/security-analytics/forwarding-ipfix-flows-from-flow-sensor-to-third-party-device/td-p/4015905

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: