Stealthwatch (Security Analytics) Sensor Question

[bmurphree@myemma.com]

Question: What's the fastest way to determine which sensor reports an observation or alert in Stealthwatch?

Challenge: I have multiple sites with Cisco FTD firewalls, managed by CDO. I also have several ONA sensors deployed throughout a global network. When I see an alert in Stealthwatch, the observation is informational, but I don't see an obvious way to determine what sensor reported the issue or observation. The closest I've found to this is to pre-determine subnets, but that doesn't stop a rogue intruder from connecting to a network device and spinning up a new VLAN or sub-interface (assuming my security was weak).

Any ideas? Thanks!

[rocedar]

Hello - Sorry this took so long to answer - I just recently got assigned to SCA.  

You can tell which sensor uploaded the information here:  From Monitoring > Observations > Select the Dropdown next to the 'Time' of the observation and select 'Session Traffic > This brings up the session traffic, scroll window to the far right for the 'Sensor' column.    You should see the name of the sensor that uploaded the information.