WEBVTT 1 00:00.000 --> 00:06.300 All right, next up on the Cisco Security Suite is StealthWatch. 2 00:06.300 --> 00:11.680 StealthWatch came to Cisco via an acquisition and it is now a, it has a new 3 00:11.680 --> 00:12.200 name like a 4 00:12.200 --> 00:13.200 lot of these other products. 5 00:13.200 --> 00:18.480 It is known as Secure Network Analytics. 6 00:18.480 --> 00:22.170 So you can see what Cisco is largely doing here is they're trying to create 7 00:22.170 --> 00:22.800 names that 8 00:22.800 --> 00:26.000 describe what exactly their products do. 9 00:26.000 --> 00:29.830 Because StealthWatch doesn't really tell us much secure network analytics tells 10 00:29.830 --> 00:30.280 us a little WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:29.830 --> 00:30.280 us a little 11 00:30.280 --> 00:32.200 bit more about what's happening here. 12 00:32.200 --> 00:36.740 As we might guess, this is about looking at network analytics in order to 13 00:36.740 --> 00:37.720 better secure 14 00:37.720 --> 00:39.120 our network. 15 00:39.120 --> 00:42.100 So the way StealthWatch works, and we'll just keep calling it StealthWatch to 16 00:42.100 --> 00:42.640 not go back 17 00:42.640 --> 00:47.250 and forth, is that StealthWatch is a software package that sits on our network, 18 00:47.250 --> 00:47.840 and it's 19 00:47.840 --> 00:53.080 going to serve as a net flow collector. 20 00:53.080 --> 00:57.770 And when it's running a net flow, what that means is we're creating network 21 00:57.770 --> 00:59.200 flow configurations 22 00:59.200 --> 01:03.500 on all of these network devices like switches and routers, and we're sending WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 00:59.200 --> 01:03.500 on all of these network devices like switches and routers, and we're sending 23 01:03.500 --> 01:04.720 net flow information. 24 01:04.720 --> 01:09.760 Now net flow is not going to send the entire packet of information. 25 01:09.760 --> 01:17.340 We don't send the packet body, but rather instead, we send the packet headers. 26 01:17.340 --> 01:19.560 And the headers tell us a whole lot of information. 27 01:19.560 --> 01:22.880 We can call this the metadata of the packet. 28 01:22.880 --> 01:26.680 For example, it tells us the source and destination IP address. 29 01:26.680 --> 01:28.680 It tells us the source and destination ports. 30 01:28.680 --> 01:32.920 And there's some other information in there as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 30 01:28.680 --> 01:32.920 And there's some other information in there as well. 31 01:32.920 --> 01:36.570 Well, a lot of our software packages that receive net flow data is going to 32 01:36.570 --> 01:37.200 tell us what's 33 01:37.200 --> 01:40.520 happening on the network from a traffic flow perspective. 34 01:40.520 --> 01:47.400 But StealthWatch is going to be looking specifically for attack patterns. 35 01:47.400 --> 01:52.080 Because there's not a whole lot new under the sun, as they say. 36 01:52.080 --> 01:57.000 And we're talking about threat actors coming in and attacking our network. 37 01:57.000 --> 02:01.360 And again, usually what's happening here, let me draw the threat actor over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:57.000 --> 02:01.360 And again, usually what's happening here, let me draw the threat actor over 38 02:01.360 --> 02:01.920 here. 39 02:01.920 --> 02:06.820 What's happened is that the threat actor has compromised a device, an endpoint 40 02:06.820 --> 02:07.240 that's 41 02:07.240 --> 02:08.680 on the network. 42 02:08.680 --> 02:11.850 And maybe in some capacity where they're not running AMP or AMP hasn't detected 43 02:11.850 --> 02:12.960 it yet, 44 02:12.960 --> 02:16.770 but whatever the situation is, we're sending traffic out on the network trying 45 02:16.770 --> 02:17.320 to get to 46 02:17.320 --> 02:21.160 a particular target, maybe a data store in the data center. 47 02:21.160 --> 02:27.790 So as we see, this is creating a traffic flow from this endpoint to this device 48 02:27.790 --> 02:28.280 on the other 49 02:28.280 --> 02:29.880 side of the network. 50 02:29.880 --> 02:34.200 So if we're configured for net flow and we're sending this information to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 50 02:29.880 --> 02:34.200 So if we're configured for net flow and we're sending this information to 51 02:34.200 --> 02:35.960 StealthWatch, StealthWatch 52 02:35.960 --> 02:39.870 ideally is going to pick up on the fact that this looks like a rather 53 02:39.870 --> 02:41.360 suspicious pattern. 54 02:41.360 --> 02:46.230 And namely, we've got this endpoint that usually doesn't download a whole lot 55 02:46.230 --> 02:47.200 of information 56 02:47.200 --> 02:51.080 from whatever file server or data store this is. 57 02:51.080 --> 02:56.260 And yet all of a sudden it's hammering these devices and it's trying to look at 58 02:56.260 --> 02:56.880 a bunch 59 02:56.880 --> 02:59.760 of ports or whatever the situation is. 60 02:59.760 --> 03:02.640 There can be several different key things to look for here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 02:59.760 --> 03:02.640 There can be several different key things to look for here. 61 03:02.640 --> 03:07.370 For example, an unusual level of activity, as we just mentioned, we might not 62 03:07.370 --> 03:07.760 expect 63 03:07.760 --> 03:10.320 this endpoint to target this device very often. 64 03:10.320 --> 03:14.690 And all of a sudden that's all it's doing is sending a bunch of traffic to this 65 03:14.690 --> 03:15.560 endpoint. 66 03:15.560 --> 03:19.240 We might also see that it's performing network scans. 67 03:19.240 --> 03:22.600 This is pretty common for threat actors to want to scan the network. 68 03:22.600 --> 03:25.940 They need to figure out that there even is this data store out there, what the 69 03:25.940 --> 03:26.480 IP address 70 03:26.480 --> 03:27.480 is. 71 03:27.480 --> 03:29.060 They don't usually know that information. 72 03:29.060 --> 03:33.350 So they run network and port scans and StealthWatch is pretty good at picking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 72 03:29.060 --> 03:33.350 So they run network and port scans and StealthWatch is pretty good at picking 73 03:33.350 --> 03:34.120 up on those kinds 74 03:34.120 --> 03:35.420 of things. 75 03:35.420 --> 03:39.280 We also might pick up on the concept of data hoarding. 76 03:39.280 --> 03:40.440 This is an interesting one. 77 03:40.440 --> 03:42.240 What is data hoarding? 78 03:42.240 --> 03:47.610 Data hoarding is when we have an endpoint that all of a sudden decides, not 79 03:47.610 --> 03:48.680 necessarily 80 03:48.680 --> 03:55.080 all of a sudden, but it's trying to download as much data as possible from the 81 03:55.080 --> 03:56.160 network. 82 03:56.160 --> 03:58.000 So it's all about the data. 83 03:58.000 --> 04:00.760 We've got so many terabytes of data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 83 03:58.000 --> 04:00.760 We've got so many terabytes of data. 84 04:00.760 --> 04:03.860 Why would one device, especially one that doesn't normally download a lot of 85 04:03.860 --> 04:04.320 network 86 04:04.320 --> 04:07.960 data be trying to gobble up as much data as possible? 87 04:07.960 --> 04:11.800 And when by saying that, I just mean it's trying to download it. 88 04:11.800 --> 04:15.200 Well, probably it's going to offload it to the threat actor because again, they 89 04:15.200 --> 04:15.440 want 90 04:15.440 --> 04:17.920 to steal all of this information. 91 04:17.920 --> 04:22.400 So as the information is all of a sudden getting downloaded in a torrent 92 04:22.400 --> 04:23.320 towards this 93 04:23.320 --> 04:28.800 particular endpoint, well, that again shows up as a pattern and StealthWatch 94 04:28.800 --> 04:29.560 ideally is 95 04:29.560 --> 04:32.080 going to pick up on that and let us know. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 95 04:29.560 --> 04:32.080 going to pick up on that and let us know. 96 04:32.080 --> 04:34.280 Now fortunately, StealthWatch has some integration. 97 04:34.280 --> 04:38.660 So first and foremost, like we said, StealthWatch is going to be pulling net 98 04:38.660 --> 04:39.840 flow information 99 04:39.840 --> 04:43.250 from the network, which means that we do have to configure net flow on our 100 04:43.250 --> 04:44.760 network devices. 101 04:44.760 --> 04:51.000 However, we also have integration with Cisco's XDR platform. 102 04:51.000 --> 04:54.160 And so this is one of these platforms that we're probably going to want to 103 04:54.160 --> 04:54.800 deploy into 104 04:54.800 --> 04:58.770 our network if we consider ourselves to be a Cisco security shop because we're 105 04:58.770 --> 04:59.160 going 106 04:59.160 --> 05:02.660 to have a lot of appliances in the network, including StealthWatch or again, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 106 04:59.160 --> 05:02.660 to have a lot of appliances in the network, including StealthWatch or again, 107 05:02.660 --> 05:03.400 secure network 108 05:03.400 --> 05:09.320 analytics that are going to be just a source of information for us. 109 05:09.320 --> 05:12.590 And in order to help us digest it, we're going to want to leverage Cisco's 110 05:12.590 --> 05:13.120 platform like 111 05:13.120 --> 05:17.070 XDR in order to receive that information as well as information from other 112 05:17.070 --> 05:17.760 sources and 113 05:17.760 --> 05:21.860 aggregate it and let us know that hey, something happens or it happens to be 114 05:21.860 --> 05:22.720 happening on our 115 05:22.720 --> 05:24.360 network and we might want to check it out.