All right, next up on the Cisco Security Suite is StealthWatch.
StealthWatch came to Cisco via an acquisition and it is now a, it has a new
name like a
lot of these other products.
It is known as Secure Network Analytics.
So you can see what Cisco is largely doing here is they're trying to create
names that
describe what exactly their products do.
Because StealthWatch doesn't really tell us much secure network analytics tells
us a little WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
us a little
bit more about what's happening here.
As we might guess, this is about looking at network analytics in order to
better secure
our network.
So the way StealthWatch works, and we'll just keep calling it StealthWatch to
not go back
and forth, is that StealthWatch is a software package that sits on our network,
and it's
going to serve as a net flow collector.
And when it's running a net flow, what that means is we're creating network
flow configurations
on all of these network devices like switches and routers, and we're sending WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on all of these network devices like switches and routers, and we're sending
net flow information.
Now net flow is not going to send the entire packet of information.
We don't send the packet body, but rather instead, we send the packet headers.
And the headers tell us a whole lot of information.
We can call this the metadata of the packet.
For example, it tells us the source and destination IP address.
It tells us the source and destination ports.
And there's some other information in there as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there's some other information in there as well.
Well, a lot of our software packages that receive net flow data is going to
tell us what's
happening on the network from a traffic flow perspective.
But StealthWatch is going to be looking specifically for attack patterns.
Because there's not a whole lot new under the sun, as they say.
And we're talking about threat actors coming in and attacking our network.
And again, usually what's happening here, let me draw the threat actor over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And again, usually what's happening here, let me draw the threat actor over
here.
What's happened is that the threat actor has compromised a device, an endpoint
that's
on the network.
And maybe in some capacity where they're not running AMP or AMP hasn't detected
it yet,
but whatever the situation is, we're sending traffic out on the network trying
to get to
a particular target, maybe a data store in the data center.
So as we see, this is creating a traffic flow from this endpoint to this device
on the other
side of the network.
So if we're configured for net flow and we're sending this information to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we're configured for net flow and we're sending this information to
StealthWatch, StealthWatch
ideally is going to pick up on the fact that this looks like a rather
suspicious pattern.
And namely, we've got this endpoint that usually doesn't download a whole lot
of information
from whatever file server or data store this is.
And yet all of a sudden it's hammering these devices and it's trying to look at
a bunch
of ports or whatever the situation is.
There can be several different key things to look for here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There can be several different key things to look for here.
For example, an unusual level of activity, as we just mentioned, we might not
expect
this endpoint to target this device very often.
And all of a sudden that's all it's doing is sending a bunch of traffic to this
endpoint.
We might also see that it's performing network scans.
This is pretty common for threat actors to want to scan the network.
They need to figure out that there even is this data store out there, what the
IP address
is.
They don't usually know that information.
So they run network and port scans and StealthWatch is pretty good at picking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So they run network and port scans and StealthWatch is pretty good at picking
up on those kinds
of things.
We also might pick up on the concept of data hoarding.
This is an interesting one.
What is data hoarding?
Data hoarding is when we have an endpoint that all of a sudden decides, not
necessarily
all of a sudden, but it's trying to download as much data as possible from the
network.
So it's all about the data.
We've got so many terabytes of data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We've got so many terabytes of data.
Why would one device, especially one that doesn't normally download a lot of
network
data be trying to gobble up as much data as possible?
And when by saying that, I just mean it's trying to download it.
Well, probably it's going to offload it to the threat actor because again, they
want
to steal all of this information.
So as the information is all of a sudden getting downloaded in a torrent
towards this
particular endpoint, well, that again shows up as a pattern and StealthWatch
ideally is
going to pick up on that and let us know. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to pick up on that and let us know.
Now fortunately, StealthWatch has some integration.
So first and foremost, like we said, StealthWatch is going to be pulling net
flow information
from the network, which means that we do have to configure net flow on our
network devices.
However, we also have integration with Cisco's XDR platform.
And so this is one of these platforms that we're probably going to want to
deploy into
our network if we consider ourselves to be a Cisco security shop because we're
going
to have a lot of appliances in the network, including StealthWatch or again, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to have a lot of appliances in the network, including StealthWatch or again,
secure network
analytics that are going to be just a source of information for us.
And in order to help us digest it, we're going to want to leverage Cisco's
platform like
XDR in order to receive that information as well as information from other
sources and
aggregate it and let us know that hey, something happens or it happens to be
happening on our
network and we might want to check it out.