Cisco DNA Center’s Network Assurance and Analytics Leaves the Competition Behind

Today’s networks need Network Assurance

Network health is an important aspect of any network operation, and historically, network admins use network monitoring to keep a check on the overall health of the network. However, monitoring every part of the network often requires multiple tools which only provides a fragmented view into the network.

As the network scales and expands, the complexity in monitoring the events and data associated with a growing pool of users, things, applications and network devices rises exponentially. And replicating an issue as it occurs poses a considerable challenge. As a result, typically network admins spend more time collecting the data from different sources and tools than they do analyzing and troubleshooting the issues. Which impacts both IT and business productivity.

Network assurance and analytics solutions are designed to address these challenges by taking raw data from various sources and presenting it as actionable insights on a dashboard. So now, instead of scrambling through the data or trying to replicate the issue, a network admin knows the type of the problem, the severity of it, number of clients affected, and the location where the issue exists.

How does Cisco DNA Assurance Stack Up?

The Assurance and Analytics market is crowded with both established and emerging vendors that claim to offer full-service assurance solutions. Most vendors offer assurance capabilities in a silo: there is no holistic view of the network. Cisco DNA Assurance provides end-to-end, contextual network analytics and insights through real-time data and telemetry it collects network-wide. It also offers distinct capabilities under a single-pane-of-glass dashboard, such as Intelligent Capture, Sensor-driven Tests and Apple Wi-Fi Analytics.

And now we’ve recently added Cisco AI Network Analytics to the Cisco DNA Center arsenal, which brings the power of machine learning to better pinpoint problems and provide more accurate remediation guidance.

How do the others stack up to Cisco DNA Assurance?

Aruba Assurance has three separate wireless assurance solutions:

◈ Aruba NetInsight, a cloud-based assurance platform

◈ Aruba User Experience Insight (previously known as Cape Networks), a sensor-based assurance platform

◈ Connectivity Health, a part of Aruba Airwave platform.

Huawei has two solutions:

◈ CampusInsight, their network assurance platform

◈ eSight, their network management system which offers monitoring and basic diagnostics

Miercom Puts Cisco DNA Assurance to the Test

Miercom, a 3rd party vendor, produced an independent report that compares the publicly available versions of Cisco DNA Center, Huawei eSight and Aruba Connectivity Health. Miercom tested four issues that are common in any network and gauged how each platform helps a network admin to troubleshoot and resolve them.

What was tested?

◈ DHCP Problem: DHCP pool exhaustion, which can leave clients stranded without an IP address after they connect to an access point.

◈ RF Issues: How the systems dealt with a wireless client that was forced to join a crowded 2.4GHz band as the client couldn’t properly connect to the weak signal of the 5GHz radio of the access point

◈ Proactive Testing: The ability to proactively monitor the network via sensors and sensor-driven tests so that a potential issue or an anomaly can be detected and resolved before it turns into a major alert.

◈ Troubleshooting: The diagnostic efficiency of the Assurance platform to isolate a device or interface where a problem exists by examining the network topology through tools such as path trace

What were the results of the tests?

Cisco DNA Assurance:

Miercom concluded that Cisco DNA Center performed the best of all the tested platforms. It excelled in each test case by offering a detailed root cause analysis and step by step remediations for each issue.

Source: Miercom

The Cisco active sensor supports more than twice the test cases than Aruba Connectivity Health Sensors. Only Cisco offers a view of the physical connection of the devices with health as well as a logical connection through path trace tool that gives a full view of the end-to-end connection of a client.

The Competition:

Aruba Connectivity Health partially satisfies some of the use cases, but it doesn’t go beyond basic pre-connection statistics and lacks in providing detailed analysis of a network problem. Huawei eSight attempts to display some RF related issues but, like any network monitoring tool, it forces a network admin to search for an issue rather than displaying it on the dashboard for faster analysis and resolution.

Continue reading

Word of Mouth is an Even Bigger Deal for B2B than B2C

Ninety-one percent of anything is a big deal, which is why you need to pay attention to this: ninety-one percent of B2B purchases are influenced by word of mouth.

A study by Blanc & Otus and G2Crowd shows the impact of recommendations and referrals in B2B is actually far greater than B2C, due to the considered nature of most purchases. Nobody is going to make a decision or give you money unless they’ve checked you out — unless they’ve vetted you — with a current customer first.

As businesses, we assume our customers talk about us. We assume our customers tell our story. But we leave our customers to their own devices to do this. For something that’s as important as word of mouth, we’re way too hands-off. Most businesses don’t have a word of mouth strategy. At best, we’re doing word of mouth on accident.

I recently released Talk Triggers, a book about word of mouth, which I co-authored with Daniel Lemin. A Talk Trigger is a strategic, operational differentiator a business adopts to create conversation and a marketing advantage. A Talk Trigger has four key components:

1. It Must Be Remarkable.If it’s not worth remarking on, it’s not remarkable.
2. It Must Be Relevant. Doing something just to get noticed is not a Talk Trigger.
3. It Must Be Reasonable.A Talk Trigger is remarkable enough to be a conversation catalyst but reasonable enough to be trusted.
4. It Must Be Repeatable. A Talk Trigger must be available to every customer, every time.

A Talk Trigger isn’t a PR gimmick, it’s not a surprise-and-delight tactic. Like I said, it’s a strategic, operational differentiator your customers wantto talk about. Here are three examples of B2B companies that are word of mouth pioneers.

Spiceworks

Back in 2006, Austin-based Spiceworks decided it would upend the established protocol for software provision and use, and would instead, give its software away to IT professionals to manage their networks for free. The company was motivated by a realization that IT professionals have tough jobs. At the time, they didn’t have a common set of tools to help them.

Spiceworks launched a product suite that allowed IT pros to scan their computing network, monitor up-time, and track issues or problems via a built-in digital help desk. It monetized through highly-targeted and highly-tailored ads.

To get feedback from early users, Spiceworks set up a web page where customers could submit product ideas. Users voted by “spicing up” or “spicing down” the suggestions they were most interested in. Spiceworks realized the collaboration and community needs of IT professionals superseded their software needs, and it formed an online support group.

As conversations grew, developed and morphed into longer threads that covered topics beyond IT, Spiceworks knew it was on to something. In 2010, Spiceworks opened the community to non-customers. That’s when word of mouth kicked in. That’s when people started to tell their friends and colleagues that if they were in IT, they needed to go to the Spiceworks community. It was THE place to be.

FreshBooks

The accounting and bookkeeping software company, Freshbooks, executes its Talk Trigger a little differently. Its “I Make A Living” program is a traveling series of events where the company goes to its customers.

Let me explain.

Freshbooks’ customers are self-employed. Their businesses span a range of industries from interior design to accounting to plumbing. When Freshbooks first began, it was small. Its founder, Mike McDerment, was cautious about spending money on travel for conferences and events.

On a trip to New York, McDerment decided to email some customers and invite them to dinner. This idea turned into an entire program. Today, when Freshbookers (employees) travel they seek out customers and organize group dinners with them. Sometimes the group is 20 people, other times it’s 120. The dinners are done at no-cost to Freshbooks’ customers.

These events connect business owners in the same community, an opportunity not everyone has. The dinners have led to a series of live events, known as #IMakeALiving, where Freshbooks brings in authors, speakers and experts to share information with their customers. It’s all free, and the program generates considerable word of mouth.

Amazon Web Services

This last one is a bit of a cheat, but it’s an example I recently shared as a guest on the #FlipMyFunnel podcast hosted by ABM extraordinaire, Sangram Vajre. Sangram asked me for a Martech example, and I thought of Amazon Web Services.

If Amazon Web Services adds capacity, services, or adds to a data center to the point where costs go down as it scales up, they email their customers in the region — proactively — and alert them their bill will be lower beginning next month. This is a tremendous example of a company doing something its customers do not expect.

This example is not a true Talk Trigger because, at this point, it’s not repeatable. Remember the four key components? Amazon Web Services only does this in regions that have cost savings. If it happened to every customer, it’d be one of the most tremendous Talk Triggers I’ve seen.

Continue reading

Cisco CCENT Certification: Jump start your career in the IT Networking Field

ICND1 and ICND2 are the most popular Cisco certifications that will qualify you to start your career as a network engineer. Some applicants prefer taking the composite exam, but some others prefer to take both the exams separately. ICND1 is the entry-level exam, and it qualifies you to manage different devices in an organization. At the same time, ICND2 is the Associate level exam that gives a notable boost to your skills.

And it allows you to understand the connection between various devices. Here, we are going to talk about the CCENT ICND1 certification exam. You’d be able to receive CCENT certification after passing this exam. The competition in the networking industry has grown nowadays so, and you may not be able to get a job without this certification.

However, CCENT certification is still important if you are willing to develop excellent basic skills. If you thought to take the composite exam for CCNA, you’d find it challenging to complete the entire syllabus that is available for this exam. Therefore, it is advisable that you should take these exams independently. Thus, you’d be able to pass the exam, and you’d also score higher marks in the exam.

• ICND1 Certification: The Stepping Stone for All Cisco Certifications and Careers

If you wish to become an expert in the networking industry, then CCENT certification is a must for you as it helps you strengthen your skills gradually and open a broad array of opportunities for career promotion.

How to become CCENT certified?

The applicants that take CCENT exam usually have an intention of becoming CCNP Routing & Switching certified, although you can prefer any field you want to progress in, for instance in security, design, Data Center, Cyber Ops, Wireless, etc. So, if you also have the chosen Routing and Switching specialization, then CCENT certification is the first step you are going to take. Then you’d have to pass the CCNA certification exam. And the final step you are going to take is to pass the CCNP Routing & Switching certification exam, which is a combination of three different exams. Once you have successfully followed through all these steps, you’d be acknowledged as CCNP Routing & Switching certified.

CCENT Exam Details

The Cisco 100-105 exam is just like any other exam: there is a fixed exam structure that is occasionally updated, but it prevails the same for the most part. Currently, the CCENT exam consists of 45-55 questions, and all of them must be answered in 90 minutes. Take your time with each question, but keep in mind the time limit. With so many difficult questions to answer, time management is essential.

The CCENT exam questions come from different syllabus topics, but five main ones make up most of the Cisco 100-105 exam. They are as follows:

• LAN Switching Fundamentals (26%)
• Routing Fundamentals (25%)
• Network Fundamentals (20%)
• Infrastructure Services (15%)
• Infrastructure Maintenance (14%)

Tips for Passing the Cisco CCENT Certification Exam

The Cisco 100-105 exam is just like any other exams, and you will have to prepare yourself properly to pass it with a flying score. First of all, you require to understand that you have to start your preparation promptly. You should begin a few months before the exam is scheduled so that you have sufficient time to study. Remember that if you get your hands on this certification, then it can do wonders for you, so work hard and try to pass the exam it on the first attempt.

Making Schedule is an important part of thinking about when it comes to preparation for Cisco exams because there are quite a few topics that you need to study, and you have to give each topic the proper time that it demands. If you have created a study plan, then make sure that you follow it strictly. Otherwise, it will be meaningless.

The Cisco 100-105 exam is not exactly new, so it will be easy for you to obtain many study resources on the Internet. There are many online forums where people from all around the world come together to talk about this test. Participate in these communities and interact with other applicants there. All these people can turn out to be a precious asset because they can give you links for other sources that you can take to prepare for the exam. Some of them might also share their experience of how they studied for the Cisco 100-105 certification exam.

• How to Prepare for CCENT Certification Exam?

While you are at it, you should also study from the official study guide. It will inform you about the main topics that you need to concentrate on, and what the exam will be all about. Use this study resource to your benefit and stay close to it because the information included in it can help you pass the exam on the first try.

The practice is always an advantage, and you should never ignore that. If you wish to practice for the 100-105 exam, then the Internet is your best friend. Here you can find many platforms that offer Cisco CCENTpractice tests, which consist of the questions that have been written by seasoned and experienced professionals. Take as many of these practice tests as you can because this is the closest you can get to the actual exam environment. Some of these practice tests might also display you your result at the end, and this way, you can assess your skills before the actual CCENT exam. You can then identify the topics that demand more learning and start focusing on them.

CCENT Recertification

Having taken the CCENT is like always beneficial. CCENT Certification has a validity period of 3 years. This indicates that you have a duration of 3 years to recertify by passing any of the following listed exams. Take a look in here.

• ICND1 exam;
• CCDE written exam;
• Current CCIW written exam;
• CCAr (Cisco certified architect)
• Current associate level;
• Current 642-XXX professional level;
• Current CCDE practical exam;

Why is the CCENT certification so Popular?

CCENT certification is the first step in your journey of becoming a network engineer. And the significance of becoming a network engineer is apparent to all. So, that is the significant reason due to which CCENT certification has become popular. Another primary reason is that it supports you to become strong right from the start. And the things you are going to receive while studying for the CCENT exam here will help you throughout your career in the networking industry. Therefore, many applicants prefer taking this certification before proceeding to the next step.

Reasons to become CCENT certified

If you are willing to enhance your skills to the expert level in the networking field, then CCENT certification is vital for you. The topics you are going to learn in the CCENT exam preparation will never fade from your memory and they will help you out at every step of the Cisco career path. CCENT plays a leading role in clearing your concepts about the things that are required already to understand in CCNA. So, you must take advantage of this certification to sharpen your necessary skills in the Networking industry.

• The CCENT confirms your networking knowledge tangible. Getting a Cisco certification proves that you perceive something about networking; networks make computing happen and connect every person in the world. Why not start with a certification that applies broadly to just about any IT job or task?
• Earning the CCENT requires passing only one exam. Obtaining a certification by passing just one test will raise your confidence and prepare you for the longer Cisco certification paths such as the Cisco Certified Network Professional (CCNP) certification.
• Certification helps demonstrate your expertise to your boss. Having CCENT certification reminds your management and colleagues of your skill every time they approach you.
• The CCENT is a stepping stone for the higher level CCNA certification. Passing the single CCNA exam can be very challenging — it's much easier to pass two smaller exams that you can more easily study for. By passing the CCENT certification exam, you're halfway on the path to obtaining your CCNA. With CCENT certification, you can jump-start your career in the IT networking field.

The CCENT certificate works more like a stepping stone towards other Cisco certificate programs. Upon passing the single networking, exam assures you that you are ready for the rest of the certificate modules. This also forms a pathway to the more in-demand certification that is the CCNA certification.

Continue reading

Get a Security System, not a Security Smorgasbord

If you’re still juggling a lot of cyber security tools, you’re not alone. Even as businesses make headway on trimming point-solutions, the recently released Cisco CISO Benchmark Report found that 14% of security leaders are managing more than 20 vendors. And 3% are dealing with over 50.

It’s easy for this to get out of hand. Customers tell us they acquired product A to solve problem A, product B to solve problem B, and so on. Before long, they’re overloaded with point-products that work independently and create tons of siloed data points. The products don’t draw connections between the data to help network administrators understand event context.

It’s almost like having alarm sensors from different security companies on every door to your home. It’s not better, simpler, or easier to manage.

Cisco is helping customers simplify their security ecosystems with powerful tools that work together to automatically thwart cyber attacks. The Cisco Integrated Security Portfolio includes Cisco Next-Generation Firewalls (NGFW) and Cisco Advanced Malware Protection (AMP) for Endpoints. These two tools automatically work together to provide comprehensive threat protection from the network edge to the endpoint. And using the Cisco Threat Response management console, you can take corrective action directly from a single interface.

The power of coordination

This powerful partnership starts with breach prevention. Stopping cyberattacks before they can embed themselves in your extended network is crucial. The Cisco NGFW and AMP for Endpoints both draw threat intelligence from the Cisco Talos Security Intelligence and Research Group to actively block threats in real time. Cisco NGFW monitors and blocks malicious traffic and files at the network perimeter, while Cisco AMP for Endpoints blocks malicious files at the endpoint point-of-inspection.

But what if an attacker or extremely sophisticated malware manages to creep inside? It can happen—cybercriminals are persistent, and malware gets smarter every day. This is where the coordination of Cisco NGFW and AMP can really make a difference. If NGFW sees a threat on the network, it’s contained there and blocked access to the endpoint. If AMP for Endpoints sees trouble on the endpoint, it is automatically quarantined there and blocked from traversing the network. Threat information and event data is shared amongst all Cisco security tools. The system works together so that if a threat is seen once, it is stopped everywhere. This provides continuous visibility across multiple attack vectors for rapid, automatic detection and response.

And the best part? This network and endpoint information is all aggregated in one place – the Cisco Threat Response management console. You can see all of this information in intuitive, configurable graphs for better situational awareness and quick conclusions. You can take corrective action and make decisions across your entire network from one management plane. You can block suspicious files, domains, and more—without having to log in to another product first. Want to see even more network or endpoint detail? One click and you’re inside Cisco AMP for Endpoints or the Cisco NGFW native console.

One proven, efficient system

We work with businesses every day to help them defend their networks and keep security management simple so their teams can be as efficient as possible. Cisco Next-Generation Firewalls and Cisco AMP for Endpoints, along with the Cisco Threat Response management console, offer breach prevention, continuous visibility, rapid detection, automated response, and efficient management from one console.

Continue reading

Engage Your Teams With New Ways of Using Your Cisco Webex Devices

If you’re like most Cisco customers, your meeting rooms and open workspaces don’t do only one job – they’re multi-purpose. And when you aren’t collaborating, your video conferencing systems in these spaces should be too.

Well, I have good news and I have great news for you. Let’s start with the good news.

The Good News

Digital signage is a new feature available on Webex Board and Room Series devices which allows you to display custom content, like signage apps and dashboards, when they aren’t being used for meetings, video calls, or presentations.

The great news? This feature creates a better workplace experience. In turn, its benefits will make you a company rock star and give your teams something to get excited about.

How Does Digital Signage Work?

Digital signage leverages the web engine we’ve built into RoomOS, the software that runs on cloud-connected Cisco Webex video devices. Digital signage enables your device to show any web page when your device is not in use – without needing any extra servers or HDMI cables. All you need to do is configure a URL.

As you walk through your office today, notice the displays in your conference rooms. Now imagine those screens being used to show custom signage when they aren’t in use. You’ve just doubled your return on investment.

Increase Your ROI

Here are some suggestions for using this feature to get an even bigger increase your return on investment even more.

Build a Stronger Brand

Corporate communications and marketing need creative, always-on ways to reach internal and external audiences. Use your video conferencing device to display branding, mission and value statements, and even to make announcements and share upcoming events.

This provides streamlined communications and consistent brand experiences throughout your office locations. I personally love this use for digital signage. Really, I love them all!

Improve the Workplace Experience

Many managers use dashboards to track and analyze key performance indicators (KPIs). Digital signage makes it easier to share KPI dashboards and other metrics with your team in real time, increasing both motivation and transparency.

Agile teams can use their video conferencing systems to display a sprint tracking dashboard for everyone to see. This saves employees and managers time when looking for project status updates and keeps teams on the same page.

Digital signage feels like a natural extension of Cisco video endpoints. When Ignite started using our Webex Board and Room Series devices for digital signage, we had a list of applications we were excited to show throughout our office. Like using our Webex board to display open service tickets.

Updating the digital signage for individual endpoints is simple, logical and quick to take effect – making it a breeze to deploy. With the possibility of real-time updates and interactive options, the office just got significantly more dynamic overnight.
– Sonia Siezien, Adoption educator at IgniteCSG

Increase Employee Engagement

Higher employee engagement means happier, better-performing employees. Digital signage can help managers and teams to empower one another. In addition to KPIs, recognize individual and team accomplishments by displaying them in common areas to boost morale. Also, use your video device to share internal social streams and help build stronger connections and personal relationships between employees.

The use cases and possibilities for digital signage are endless. I’d love to hear in the comments section how you plan to improve communications, the workplace experience, and employee engagement.

Now What?

First, reach out to your teams to let them know about this exciting new capability of their Cisco Webex video devices. Or save yourself some time by sharing this blog! Next, enable digital signage on your cloud-connected Webex Board and Room Series devices, to share the content you want. Your team will thank you for it!

Digital signage gives you an even greater return from your video conferencing device. You can now add improved internal communications, corporate branding as well as employee engagement and motivation to its long list of benefits. Some more good news: This feature is cloud-first, not cloud only. You can expect on-premises deployment coming soon.

Continue reading

Cisco Stealthwatch Launches on DevNet

Find documentation, code examples, and a strong community of fellow API developers eager to help

When it comes to working with a new API or technology, the learning experience provided by the vendor can have a significant impact on the success of their customers. Having worked with dozens of different APIs over the course of my career, I have experienced the highs and lows of implementing a new solution using programmatic interfaces. Some of the toughest times I have had involved products with minimal documentation, no shared code samples, and no active community of API developers with knowledge to poll. On the other hand, some of the best APIs I have worked with have thorough documentation, plenty of examples to get me started, and a strong community of fellow API developers eager to help me on my journey to success.

When it comes to network security, being able to integrate an array of products into your security suite can be crucial to ensuring a security incident is efficiently detected and mitigated before major damage occurs.

Cisco Stealthwatch Enterprise has proven to be a powerhouse for end-to-end visibility

Being able to understand the true nature of each host and its baseline behavior, as well as efficiently responding when hosts deviate from their expected behavior is a critical facet of network security. With capabilities like advanced threat detection, accelerated threat response, malware detection in encrypted traffic, and more, Cisco Stealthwatch Enterprise has proven to be a powerhouse for end-to-end visibility and vital to the success and security of thousands of businesses and enterprises across the globe. As the need for API development continues to grow each day, so does the need for proper resources to enable these developers to be as successful as possible utilizing these programmatic interfaces. With so much important data, telemetry, and analytics inside a single tool, it makes obvious sense to extend those capabilities with an API.

Stealthwatch Enterprise has joined the DevNet community!

Being able to provide our users with a “one-stop-shop” for everything related to Stealthwatch APIs ensures that all of the relevant information essential for success is readily available and easily accessible. With the Stealthwatch Enterprise launch on DevNet, we are rolling out an array of useful tools to help API developers spend less time learning APIs and more time using these APIs.

What resources are planned for Stealthwatch and DevNet?

To begin with, we are joining the rest of the Cisco offerings by hosting the entirety of the Stealthwatch Enterprise REST API documentation on DevNet, including for our new Cognitive Intelligence REST API capabilities launched in version 7.1.0 of Stealthwatch Enterprise. No longer will developers need to jump around between different resources or be forced to search deep inside of user guides and help menus to find the relevant API information they are looking for. Now, they can simply go to the same place they already go to for the rest of their Cisco products to get all of the important information needed to make them successful.

Working code examples help you get started

On top of API documentation, we are also launching a set of Postman collections and Python sample scripts to allow developers a great starting point with their API development. Having working examples of code can be a major advantage when getting started with a new API, so including an array of working examples is an absolute necessity for our users’ success.

But we aren’t just stopping there – aside from the API documentation and sample scripts, we are also launching a Code Exchange for Stealthwatch Enterprise. Now, API experts will be able to share useful scripts and software capabilities that leverage Stealthwatch Enterprise with the rest of the DevNet community.

To round out this new community, we are also launching a new Cisco Forum specifically for API developers to ask and answer questions related to Stealthwatch APIs, serving not only as a way to resolve any issues being faced, but also serve as a rich knowledge base of information from those who already have experience.

This latest launch on DevNet is an incredibly exciting one for us, especially having worked many hours over the past few months to ensure the utmost success for our API users. In the future, we plan to expand the DevNet resources even further to include interactive sandboxes and learning labs for Stealthwatch APIs.

Continue reading

Using Amazon Web Services? Cisco Stealthwatch Cloud has all your security needs covered

Like many consumers of public cloud infrastructure services, organizations that run workloads in Amazon Web Services (AWS) face an array of security challenges that span from traditional threat vectors to the exploitation of more abstract workloads and entry points into the infrastructure.

This week at AWS re:Inforce, a new feature for AWS workload visibility was announced – AWS Virtual Private Cloud (VPC) Traffic Mirroring.  This feature allows for a full 1:1 packet capture of the traffic flowing within and in/out of a customer’s VPC environment.  This allows for vendors to provide visibility into the entire AWS traffic, and the ability to perform network and security analytics.  Cisco Steathwatch Cloud is able to fully leverage VPC Traffic Mirroring for transactional network conversation visibility, threat detection and compliance risk alerting.

Stealthwatch Cloud is actually unique in that we have had this level of traffic visibility and security analytics deep within an AWS infrastructure for a number of years now with our ability to ingest AWS VPC Flow Logs. VPC Flow Logs allow for a parallel level of visibility in AWS without having to deploy any sensors or collectors. This method of infrastructure visibility allows for incredibly easy deployment within many AWS VPCs and accounts at scale in a quick-to-operationalize manner with Stealthwatch Cloud’s SaaS visibility and threat detection solution. In fact, you can deploy Stealthwatch Cloud within your AWS environment in as little as 10 minutes!

Additionally, we are seeing that the majority of customer traffic in, out and within a VPC is encrypted. Stealthwatch Cloud is designed from the ground up to assume that the traffic is encrypted and to model every entity and look for threats leveraging a multitude of data points regardless of payload.

Stealthwatch Cloud takes the AWS visibility and protection capability even deeper by leveraging the AWS API to retrieve a wide array of telemetry from the AWS backend to tell a richer story of what’s actually going on throughout the AWS environment, far beyond just monitoring the network traffic itself. We illuminate API keys, user accounts, CloudTrail audit log events, instance tags, abstract services such as Redshift, RDS, Inspector, ELBs, Lambdas, S3 buckets, Nat Gateways and many other services many of our customers are using beyond just VPCs and EC2 instances.

Here is a screenshot from the customer portal with just a sample of the additional value Stealthwatch Cloud offers AWS customers in addition to our network traffic analytics:

The following screenshot shows how we are able to extend our behavioral anomaly detection and modeling far beyond just EC2 instances and are able to learn “known good” for API keys, user accounts and other entry points into the environment that customers need to be concerned about:

Combine this unique set of rich AWS backend telemetry with the traffic analytics that we can perform with either VPC Flow Logs or VPC Traffic Mirroring, and we are able to ensure that customers are protected regardless of where the threat vector into their AWS deployment may exist – at the VPC ingress/egress, at the AWS web login screen or leveraging API keys.  Cisco is well aware that our customers are using a broad set of services in AWS that stretch from virtual machines to serverless and Kubernetes.  Stealthwatch Cloud is able to provide the visibility, accountability and threat detection across the Kill Chain in any of these environments today.

Continue reading