What do I need to buy to do ETA?

[dmexicot]

Slide seems to indicate ETA comes with DNA-A on 9Ks.  So does Stealthwatch come with a DNA Advantage subscription?

[brford]

Great question.

The ability to process ETA meta data in Stealthwatch is a feature in version 6.9.2 and laterthat doesn't require any additional license.  That feature is off by default and needs to be enabled on both the SMC and Flow Collector.  See https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cta/configuration/SW_6_9_1_Stealthwatch_and_CTA_Configur… for more information.

Those Catalyst 9000s each come with a 'flow license' that is added to the Stealthwatch solution to increase it's 'Flow Rate License'.  So if you bought 10 Catalysts 9300s and each came with a 50 FPS license you can add 500 fps (50 x 10 units) to your Stealthwatch fps simply by pointing that out to your Cisco customer success manager.

I do not believe Stealthwatch is part of the DNA Advantage licensing at this time but that is always subject to change.  You should check with your Cisco partner or account manager.

Stealthwatch is currently bundled with many Enterprise License agreements.  That means if you have an ELA you are entitled to use Stealthwatch and it's components for the term of that ELA.

[aroondsouza]

You will need to buy C1 advantage to get Stealthwatch and ISE base + Plus.  If you need additional flows select the upgrade within C1 itself as it is cheaper or buy it A-LA-CARTE.

[brford]

To be clear you would need to purchase Catalyst 9000 switches with the C1 license which grants a one year Stealthwatch Flow Collector and SMC license.

[Michael McPhee]

ETA is a feature that combines 3 things, 2 of which you pay for.  1) You need a capable platform - as Brian mentioned the Catalyst 9000 was certainly the first, but the IOS-XE based routing platforms like the CSR1KV and ISR4K are also able to support.  2) You need Stealthwatch Enterprise with flow allocations.  Both 1 & 2 can be purchased together as part of the Cisco ONE licensing for Access.  3) The last piece comes as a result of being a Stealthwatch customer - Cognitive Threat Analytics (CTA) or Global Threat Analytics (GTA), as it is now being called - again, C1 helps you check all three boxes, and with the new term arrangement in C1, we no longer only offer the 1 year intro deal with Stealthwatch and ISE but a coterminous 3 or 5 year term (7 might be there as well).