- 1. Quick Reference – README & SAVE TIME
- AnyConnect 4.x Network Visibility Module (NVM) Demo
- Introduction
- Audience
- Scope
- 2. Understanding the Products
- Product Overview
- Product Packaging
- Product Packaging: Support
- 3. Understanding the CESA Architecture & Where to Find Deployment Documentation
- Components Overview & Documentation
- 4. Components for a Proof of Value
- 5. POV KIT INSTRUCTIONS
- Installing Cisco NVM Apps:
- Steps to Add Sample CESA/NVM Data:
- 6. Real client POV
- 7. Real Client POV Server Sizing
- 8. What is needed for the real-client POV
- Associated dCloud Lab & demo (hands on)
- Support
- Additional information from our experts
Cisco Endpoint Security Analytics (CESA) Built on Splunk Quickstart POV Kit & Deployment Guide
The latest version of the CESA app and TA (September 2021 v4.0.1)
POV Kit Data (attached bottom of page) - Sep 2021 - contains avgupd process name for linux running once a day for a period of time (1st to 10th of the month) then stopping, this is for the security evasion use case (lab guide attached at the bottom and also http://cs.co/cesa-guide).
 |
For an offline or printed copy of this document, simply choose ⋮ Options > Printer Friendly Page. You may then Print, Print to PDF or copy and paste to any other document format you like. |
1. Quick Reference – README & SAVE TIME
This guide outlines:
● 10-Minute CESA POV Kit – If all you want is the POV Kit, just download the file at bottom of this community page. Within that .zip file is everything you need for POV, including instructions on how to use the Kit.
Note: if you're going to quickly work with the sample data then you don't need a full version of Splunk. You can install one quickly on your own laptop. If you intend to move into real data POV then you will need the collector which won't run on windows, if you want something full featured move right into Splunk Enterprise on Linux (more information below)
● Full Customer Pilot POV – This is for customers who want to configure their own AnyConnect clients to generate NVM telemetry for their POV or pilot instead of using the pre-populated NVM data set in the 10-Minute POV Kit. Read this document for guidance on a full POV/pilot. This will require the configuration of the collector on the splunk instance. For more details read the Anyconnect NVM collector info and Install and Configure AnyConnect NVM 4.7.x or Later and Related Splunk Enterprise Components for CESA
● Production Deployment – Read this document for guidance on full CESA deployment.
AnyConnect 4.x Network Visibility Module (NVM) Demo
Introduction
This quickstart deployment guide is designed to direct users of Cisco® Endpoint Security Analytics (CESA) Built on Splunk to detailed documentation on how to setup a proof of value or production deployment. This guide will help you to:
● Understand the deployment architecture of CESA Built on Splunk
● Locate detailed documentation regarding how to setup each component of a CESA deployment
Audience
This guide is intended for any user seeking to setup a proof of value or production deployment of CESA Built on Splunk.
Scope
The quickstart guide provides a brief overview of the solution components and where to find detailed deployment documentation for each of those components.
2. Understanding the Products
Product Overview
Cisco Endpoint Security Analytics Built on Splunk analyzes endpoint telemetry generated by the Network Visibility Module (NVM) built into the Cisco AnyConnect Secure Mobility Client. CESA Built on Splunk is Splunk Enterprise software that is tuned to analyze NVM telemetry produced by endpoints to detect a variety of endpoint-specific security risks and breaches, such as:
- Finding unapproved or blacklisted SaaS and client applications
- Detecting data theft and data loss
- Discovering day-zero malware and conduct threat hunting
- Identifying endpoints trying to evade security scanning or disable client-side security software
- Monitoring pertinent activity and behavior of endpoints when they are not attached to the network, such as in zero-trust deployments
- Creating endpoint software application and process whitelists
- Performing endpoint asset inventory or OS’s, user accounts, device manufacturers/model and software under IT management on the network
CESA Built on Splunk is sized on a per-endpoint basis for 1 and 3 year terms that can be deployed as:
1) a standalone AnyConnect NVM analytics platform or,
2) may be combined with an existing Splunk deployment as a feature license to add per-endpoint priced analytics specifically for AnyConnect NVM telemetry. In this feature license scenario, AnyConnect NVM telemetry does not count against the data volume license used on the broader Splunk deployment, but is instead counted on a per-endpoint basis based on the capacity of the CESA Built on Splunk endpoint capacity purchased.
Product Packaging
Cisco Endpoint Security Analytics Built on Splunk requires two product components to be a functional solution:
1. Cisco AnyConnect Apex license:
This is a term feature license on the AnyConnect client that enables the NVM telemetry to be produced by endpoints. It is this telemetry that is ingested to CESA Built on Splunk and analyzed for security threats and endpoint visibility. Without NVM telemetry, CESA Built on Splunk will not function because it will not have any endpoint telemetry to analyze. The AnyConnect Apex license is purchased separately under SKU L-AC-APX-LIC=. Learn more about AnyConnect Apex licenses at https://www.cisco.com/c/dam/en/us/products/security/anyconnect-og.pdf.
If you don't already have Anyconnect APEX licenses you are able to run up to 5 clients for free to try it out.
2. Cisco Endpoint Security Analytics Built on Splunk:
This is the product described in this ordering guide. It ingests the AnyConnect NVM telemetry from endpoints and performs analytics that detect security threats and provides visibility for those endpoints. NVM data is essentially useless without CESA to analyze the data.
The primary subscription SKU is CESA-SPLUNK-SUB, which has three configurable SKU options under it:
1) CESA-SPLUNK-LIC includes a Splunk on-prem capacity license for NVM telemetry and is for initial orders of CESA with Splunk capacity and any subsequent orders adding 2500 or more endpoints;
2) CESA-SPLUNK-UPG which is for adding less than 2500 endpoints to an existing CESA-SPLUNK-LIC on-prem deployment.
3) This 3rd CESA-BYOC-LIC (“Bring Your Own Capacity”) license differs from the previous two in that it DOES NOT include Splunk capacity. It is a license solely for the Cisco components of Cisco Endpoint Security Analytics (CESA) on Splunk (event analytics/dashboard and endpoint NVM data collector), AnyConnect NVM Add-On for CESA (data normalization and translator) and Cisco TAC support. This license may be purchased with no minimum endpoint quantity but must match the number of AnyConnect endpoints being supported in the CESA deployment. This SKU is designed as an alternative to CESA-SPLUNK-xxx SKUs for customers who: a) already have sufficient Splunk capacity to accommodate the 10MB per endpoint per day of NVM telemetry that endpoints generate, or b) have fewer than 1500 endpoints in their deployment, in which case it is often less expensive to purchase Splunk capacity from Splunk vs. purchasing the CESA-SPLUNK-LIC that starts at 2500 endpoints.
- For cisco/partners, learn more about CESA Built on Splunk licenses and more at sales connect
- For customers please reach out to your account team.
Product Packaging: Support
Support and CESA software upgrades are included with the CESA Built on Splunk product. Since CESA and AnyConnect NVM are a joint solution with components sold separately, they each have distinct support offerings as outlined below. Note that Splunk support, in addition to Cisco TAC support, is included with CESA-SPLUNK-xxx SKUs. Cisco TAC will support installation, troubleshooting and issue resolution up to the point of confirming proper operation of AnyConnect NVM and Cisco components of CESA. When it becomes clear that the issue is with the underlying Splunk deployment and not CESA/NVM, customer will be referred to Splunk support.
Cisco Endpoint Security Analytics Built on Splunk:
“Standard” support is provided by Splunk (CESA-SPLUNK-xxx SKUs only) and by Cisco TAC as part of the product purchased from Cisco. Standard support includes 24x7 for P1 cases. Upgraded “Premium” support for Splunk may be purchased directly from Splunk and offers 24x7 for P1/P2 cases, access to the “Advance Support Team”, as well as expedited response times. “Premium” support is not available for purchase from Cisco. Learn more at about support packages and terms at:
https://www.splunk.com/en_us/support-and-services/support-programs.html.
Cisco AnyConnect NVM support is provided by Cisco and the TAC as part of normal AnyConnect support.
3. Understanding the CESA Architecture & Where to Find Deployment Documentation
Components Overview & Documentation
From a CESA deployment perspective there are the following components:
- Cisco AnyConnect Secure Mobility Client: AnyConnect generates the Network Visibility Module (NVM) endpoint telemetry that is analyzed to serve the variety of use-cases CESA Built on Splunk performs. NVM telemetry is endpoint customized IPFIX flow data.
Deployment documentation for AnyConnect NVM:
- Install and Configure AnyConnect NVM 4.7.x or Later and Related Splunk Enterprise Components for CESA (internal - techzone)
- Cisco AnyConnect NVM Product Documentation
- How to Deploy AnyConnect NVM
- AnyConnect NVM demo/configuration video
- Management tunnel info - allows to send traffic without having a traffic tunnel up
- Cisco Endpoint Analytics Built on Splunk: CESA is the NVM-customized Splunk Enterprise platform that performs security analytics on AnyConnect NVM telemetry produced by endpoints. In addition to the base Splunk Enterprise software included in CESA, there are two NVM-specific components:
-
Cisco Endpoint Security Analytics (CESA)
This App (download at https://splunkbase.splunk.com/app/2992/) provides two functions:
- Provides pre-designed analytics dashboards to visualize, view and set alerts on the data. This component enables immediate visibility into endpoints and user activities, but can also be endlessly customized or even completely replaced with a custom developed deployment-specific CESA console using standard Splunk query and visualization capabilities.Deployment documentation for the AnyConnect NVM App for Splunk can be found on
Splunkbase at: https://splunkbase.splunk.com/app/2992/#/details.
-
Cisco Endpoint Security Analytics Add-On for Splunk -
This “technology add-on” (aka “TA” in Splunk nomenclature – downloadable at https://splunkbase.splunk.com/app/4221/) provides NVM data indexing and formatting inside CESA Built on Splunk. It takes NVM data from the endpoint “collector” translates the NVM flow data into syslog that can be processed and analyzed by CESA Built on Splunk. Like any Splunk TA, it is installed within the Splunk Enterprise instance of CESA Built on Splunk. Deployment documentation for the AnyConnect NVM App for Splunk can be found on Splunkbase at: https://splunkbase.splunk.com/app/4221/#/details.
- The package also contains the “collector” for NVM flows coming from endpoints; this collector component may be installed directly on a Splunk forwarder in the CESA Built on Splunk instance or on a separate Linux-based server (or docker). For demo environments the solution can also be run on a single 64-bit Linux system that includes both the NVM collector and Splunk Enterprise components for demonstration purposes. (You can see the install information under details)
-
What is needed for a real-client cloud deployment?
Note: for simulated data POV only a cloud instance of Splunk is needed with the CESA dashboard and TA Add-on Apps
- Splunk Cloud with apps for NVM dashboard and TA Add-on
- Forwarder (on-site) with TA Add-on App
- Collector (either on forwarder or separate linux/docker)
What about load balancing traffic from Anyconnect NVM to multiple collectors or destinations
For example: for high availability or using with Stealthwatch. Note we don't support setup or design of these systems. It all depends on customer needs in their environment.
- Cisco Telemetry Broker to send data to the NVM collector and Stealthwatch at same time.
- does not support DTLS. It will support non-DTLS use cases for NVM.
- AWS UDP Loadbalancer supports stickiness:
https://aws.amazon.com/elasticloadbalancing/features/ - DTLS Support
- Any UDP loadbalancer can be used for that purpose as long as it supports stick-load-balancing when DTLS is being used.
4. Components for a Proof of Value
There are two types of POV available for CESA:
1) The 10-Minute CESA POV Kit enables an existing Splunk customers to use this kit to load all CESA components and a sample NVM data set into their existing Splunk environment. This is the simplest and fastest way for a customer to get a feel for CESA as it does not require any AnyConnect configuration. As the name indicates, an experienced Splunk customer can get a CESA POV running in 10 minutes with this kit. Anyone may download the kit data (attached to the bottom of this page, note this was last updated in July so you can't use the last 30 days). All documentation needed for this kit is contained on this page and in the kit.
2) A Full Customer Pilot POV is for customers who do not already have Splunk or want to generate NVM telemetry for the POV/pilot from their own AnyConnect clients. Procedure for this approach is detailed directly below.
All the components needed to setup a full customer pilot or proof of value deployment for CESA can be downloaded for trial and run on a single server, as follows:
- Splunk Enterprise from https://www.splunk.com/en_us/download/splunk-enterprise.html. A free version is available (after registration) with a limited feature set and daily data volume, but it is sufficient for testing or POC. The main feature missing is event alerting, but all other functions needed to run CESA Built on Splunk are present.
- Both the NVM App for Splunk and the NVM Add-On for Splunk can be downloaded for free from www.splunkbase.com after registering on splunk.com. Once your Splunk Enterprise software is setup, install this App and Add-On per the documentation above.
- Install the collector with information from the details at Anyconnect NVM
- If AnyConnect is already available in the environment, you may run NVM on up to 5 clients without an AnyConnect Apex license for testing purposes. If AnyConnect is not already present in the test environment, trial licenses may be downloaded at cisco.com.
This document provides simple step-by-step instructions to run the Cisco Endpoint Security Analytics Built on Splunk (CESA) proof of value (POV) kit in your existing Splunk environment. You can follow the instructions below or you can just watch the installation video contained at then end of the instructions.
5. POV KIT INSTRUCTIONS
What this POV Kit Does:
Enables you to try out CESA in your existing Splunk environment without having to generate your own AnyConnect NVM telemetry from your organizations AnyConnect endpoints (if you're wanting to use real clients continue with the installation of the apps but skip the section working with the sample data). Instead you can import the AnyConnect NVM data set provided in this kit into your Splunk instance, install the Splunk App and Add-On noted below and you’re ready to work with CESA.