Cisco Stealthwatch is a security solution that uses NetFlow to provide visibility across the network,

data center, branch offices, and cloud. NetFlow is a protocol that collects and exports statistics on

network traffic flows from routers, switches, firewalls, and other devices. NetFlow data can be used

to monitor network performance, troubleshoot issues, detect anomalies, and identify security

threats. Cisco Stealthwatch analyzes NetFlow data from various sources and correlates it with other

contextual information, such as identity, device, location, and threat intelligence. Cisco Stealthwatch

then applies advanced behavioral analytics and machine learning to detect and respond to malicious

activities, such as data exfiltration, malware infection, insider threats, and denial-of-service attacks.

Cisco Stealthwatch also provides comprehensive network visibility and security across hybrid

environments, including public cloud, private cloud, and on-premises networks. Cisco Stealthwatch

can integrate with other Cisco security solutions, such as Cisco Identity Services Engine (ISE), Cisco

Firepower, Cisco Umbrella, and Cisco Advanced Malware Protection (AMP), to enhance network

security and incident response capabilities. Reference:

Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 8: Cloud and

Virtual Network Security, Lesson 8.2: Cisco Stealthwatch Cloud

Cisco Stealthwatch

NetFlow for Cybersecurity and Incident Response

B