In this post, I'm going to go over host groups and why they're so critical to the StealthWatch system. Using host groups correctly in the StealthWatch system will ensure that you're alerted correctly on events and that the information given to you is more relevant to your enterprise
StealthWatch SMC Client Part 1 - Overview
StealthWatch 6.8 and ISE Integration with CA-Signed Certificate
In this blog post, I'll go over StealthWatch and ISE integration with pxGrid. With this integration, ISE will share contextual information such as username and device information with StealthWatch and it adds the ability to do rapid threat containment to quarantine misbehaving endpoints. I'm going to use a CA-signed certificate in this post and later I'll add a post with self-signed certificates.
StealthWatch ProxyWatch with WSA
In this blog post, I'm going to go over ProxyWatch with StealthWatch. Many enterprises utilize proxies to protect their networks. They provide protection at the cost of visibility to other security solutions. ProxyWatch is a licensed feature that allows StealthWatch to see the translated address and associate it with the other side of the proxy conversation which provides more accurate troubleshooting and forensics. It's a bit like NAT stitching for proxies.
StealthWatch - External Lookups
In this post, I'm going to go through configuring custom Eternal Lookups. What External Lookups allow a user to do is to investigate external IP addresses and ranges utilizing external applications and lookups. StealthWatch already comes pre-configured with a few and allows an administrator to add their own.
StealthWatch 6.8 Appliance Administration
StealthWatch 6.8 Management Web Dashboard
StealthWatch Installation and Setup
StealthWatch Introduction
Lancope was founded back in 2000 and is a leading provider of network visibility and security intelligence to protect enterprises against today's top threats. The StealthWatch System uses NetFlow, IPFIX and other types of network telemetry to detect a wide range of attacks from a variety of threats including APTs, DDoS, zero-day malware and insider threats. Lancope was just recently acquired by Cisco late last year but the company itself had a very close relationship with Cisco prior to that and thanks to that relationship, it integrates quite well with a variety of existing Cisco solutions. In this first post, I'm going to dig into some of the components of the StealthWatch System.