Professional Documents
Culture Documents
Stealthwatch-Study Guide
Stealthwatch-Study Guide
User’s Guide
(for Stealthwatch System v6.10.0)
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE
SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND
RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE
PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE
FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT
ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE
INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR
A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the
University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating
system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND
SOFTWARE OF THESE SUPPLIERS ARE PROVIDED "AS IS" WITH ALL FAULTS. CISCO AND THE
ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED,
INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING,
USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL,
CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST
PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE
THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY
OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual
addresses and phone numbers. Any examples, command display output, network topology diagrams, and other
figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or
phone numbers in illustrative content is unintentional and coincidental.
All printed copies and duplicate soft copies are considered un-Controlled copies and the original on-line
version should be referred to for latest version.
Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the
Cisco website at www.cisco.com/go/offices.
Back
© 2017 Cisco Systems, Inc. All Rights Reserved.
CONTENTS
1-ABOUT THIS GUIDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
About the SMC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
SMC User Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
How to Use This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Documentation Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Other Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Related Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
NetFlow Ninjas Blog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Stealthwatch Video Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Contacting Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4-HOST MANAGEMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Host Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Catch All Host Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
SLIC Threat Feed Host Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Information Reports Up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Strategies for Creating Host Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Creating Host Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Host Group Membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Relational Flow Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
OVERVIEW
This guide provides “best practice” guidelines for using the Stealthwatch Management
Console (SMC) software to minimize network performance issues and security risks.
Due to the many complexities and varieties of networks, this guide is not meant to be
a comprehensive user’s guide. Rather, the intent is to provide guidance on the best
ways to use the SMC software to handle and/or prevent network performance issues
or threats to your network.
This chapter includes the following topics:
Audience
About the SMC
How to Use This Guide
Documentation Icons
Abbreviations
Other Resources
Note:
The SMC Client Online Help is full of helpful information for using the different
components of the SMC software.
3 - Navigating the SMC Client Interface Use the common navigational elements
within the SMC.
12 - Reducing Unnecessary Alarms Locate the first host that caused an alarm
and the hosts it has affected.
Note You may find useful as you use this document or the
Stealthwatch System.
Abbreviation Definition
AS (Number) Autonomous System
CI Concern Index
CSV Comma-Separated-Value
ID Identifier
IM Instant Messaging
IP Internet Protocol
P2P Peer-to-Peer
TI Target Index
VM Virtual Machine
Related Documents
For additional information about Stealthwatch products, you can go to the
Stealthwatch User Community Web site (community.lancope.com).
OVERVIEW
As of v6.3, licensing requirements for Stealthwatch products have changed. A valid
license is required for all new installations and upgrades of the Stealthwatch System,
regardless if you purchase a product directly from Lancope or through one of
Lancope’s partners.
You may want to view the Inventory Report to help you determine what your licensing
needs are. This report provides detailed information about the Lancope products
installed on your system.
Note:
For more information about the Inventory Report, refer to “Feature License
Status” on page 29 and the SMC Client Online Help.
Each license is associated with the appliance serial number. If you have several of the
same type of appliance, be aware that each appliance must be licensed, whether it is a
physical or virtual appliance.
The following Stealthwatch features must also be licensed:
Flows per second (FPS)
Stealthwatch Labs Intelligence Center (SLIC) threat feed
Identity services
For instructions on initial licensing for a new deployment, refer to the Downloading
and Licensing Stealthwatch Products document. Use the procedures in this section to
add new licenses to your current deployment or to update existing licenses.
To purchase a new license or to renew an existing one for an appliance or feature, do
one of the following:
Contact your local Lancope partner.
Call +1 888-419-1462
Send an email to [email protected].
Note:
If you purchase a physical Stealthwatch appliance directly from Lancope, and
your SMC has Internet access, you will not need to access the Download and
License Center to activate a license.
If you have questions or problems with the Download and License Center, contact
[email protected] or call 1-888-715-4687 (within the US) or 1-408-
642-3965 (outside the US).
Note:
Use the Appliance Administration (Admin) interface to activate licenses for
standalone appliances. For information on how to use the Appliance Admin
interface to activate a license for an unmanaged appliance, refer to the Appliance
Administration Online Help.
Activating a License
To activate a new, or to update an existing, license for a feature or managed appliance,
complete the following steps:
1. Did you receive any license tokens for the appliance or feature?
If yes, go to step 2.
If no, go to step 3
5. Click Continue.
If the process succeeds, a confirmation dialog opens. Click OK to close the
dialog.
If the activation fails, an error dialog opens, listing each appliance for which
the process failed. Double-click a row in the table for more details. Click
Close to close the dialog.
If the activation fails, an error dialog opens, listing each appliance for which
the process failed. Double-click a row in the table for more details. Click
Close to close the dialog.
Item Description
Licensed Flow Collection Rate The maximum number of flows per second (in
the 95th percentile) from all Flow Collectors that
your license allows. If this rate is exceeded, the
Stealthwatch Flow License Exceeded alarm is
generated.
Days Exceeded Licensed Rate The number of days in the last 30 days that your
system has exceeded the maximum flows per
second allowed by your license.
Flow Collection Licensing Report Click the Flow Collection Licensing Report
button to view graphical and tabular data for the
system-wide rate of traffic (in FPS) that your
Stealthwatch System observes each day. You
can use this information to determine how your
actual usage compares to the limit allowed by
your license.
Item Description
Inventory Report Click the Inventory Report button to view details
about your licenses.This report can help you
determine your actual licensing needs.
- continued -
OVERVIEW
The SMC client interface contains a large collection of documents to assist you in
monitoring, protecting, and analyzing your network. Familiarizing yourself with the
common navigational elements of these documents and the interface in general will
help you become more proficient with Stealthwatch and more efficient when
analyzing events in your network.
This chapter includes the following topics:
Client Memory Allocation
Your Point of View
Enterprise Tree and Tool Tips
Opening SMC Documents
Working with Documents
Working with Tables
Working with Charts
Filtering Document Data
Printing Documents
Saving Documents
Online Help
Keyboard Shortcuts
Tip:
If you notice that the SMC client interface appears to “hang” frequently, try
increasing this value.
If you receive an error message involving Java, try selecting a lower memory
allocation.
Notes:
For information about setting up login documents, refer to “Login Documents” on
page 306 in Chapter 13, “Working with Documents.”
For information about building dashboards, refer to Chapter 5, “Views and
Dashboards.”
The Domain Dashboard is an example of a document that you may decide to have as a
login document since it provides graphical and tabular data about important activity in
the domain. This data is collected from the SMC every five minutes. By default, the
Domain Dashboard is automatically configured to be a login document for the admin
user. It is also available immediately as a scheduled document for new users; all you
have to do is enable the StealthwatchStealthwatch Daily Reports schedule and include
this document.
Note:
For information about enabling and scheduling documents, refer to “Associating
Scheduled Documents With a User’s Account” on page 340 in Chapter 14,
“Managing Users.”
By default, the
options in the Enterprise tree are collapsed. To
expand all options in the tree simultaneously,
right-click any item in the tree and select
Expand All. To collapse all items
simultaneously, right-click any item and select
Collapse All. To hide the Enterprise tree
completely, go to the Main Menu and click
View > Hide Tree, or press Ctrl+T on your
keyboard. The SMC saves the expanded and
collapsed folder settings. So the next time you
log in, the Enterprise tree appears just the way
you left it.
Note:
The Find field is hidden by default. You must click CTRL+F to open it
the first time, and then thereafter it will display each time you open the
SMC.
You can search forward and backward through the tree for additional instances of the
desired text by using any of the following methods:
Click the down and up buttons to the right of the Find field.
Tip:
You can continue to perform other operations in the SMC while a search is being
processed.
Tree Branches
The Enterprise tree branch, highlighted in this example,
is always present in the Enterprise tree. This branch
represents the top collection point for all SMC
management options, encompassing all of the domains
monitored by the SMC.
Depending on your point of view, the SMC branch may
or may not be present. This branch represents the SMC
appliance itself. If your system is using a failover SMC,
you will see both the primary and the secondary SMC
branches.
The other tree branches represent the domains that the
SMC appliance is monitoring, along with the associated
host groups, Stealthwatch Flow Collectors,
Stealthwatch FlowSensors, virtual machine (VM)
servers (i.e., ESX hosts), VMs, maps, peripheral
devices, and external devices.
Note:
FlowSensor VEs appear under both the FlowSensors branch and the VM Servers
branch.
Critical Red
Major Orange
Minor Yellow
Trivial Blue
Note:
The top-level branch icon displays the color for the highest-severity alarm
occurring for any lower-level branch.
Note:
The system updates the Enterprise tree once every minute. However, you can
refresh it at any time to see the most up-to-date information by going to the Main
Menu and clicking View > Refresh Tree. You can also right-click anywhere in the
Enterprise tree and select Refresh Tree.
Tool tips are virtually everywhere in the SMC client interface. Simply hover the
cursor over an element (e.g., a tab, graph, chart, or table cell) to see its corresponding
tool tip.
Note:
Documents are also referred to as reports. There are instances within this user
guide where these terms are used interchangeably.
Main Menu
You can click menu items from the Main Menu to open documents.
The options available will depend on the following three primary factors:
What you have clicked in the Enterprise tree
What you have clicked in a particular SMC document
Your login privileges
File Menu
The File menu provides options for working
with SMC documents, such as opening, closing,
saving, printing, and sharing documents with
other users.
Edit Menu
The Edit menu provides options for copying,
pasting, and searching for data, as well as for
defining certain display preferences.
Top Menu
The Top menu allows you to display the most
prevalent data based on specific criteria, such
as applications used most often, services used
most often, ports used most often, most active
hosts, etc. You can view this data across the
entire network or break it down according to
inbound traffic, outbound traffic, traffic within
a domain or host group, or traffic crossing a
specific interface.
Status Menu
The Status menu provides options for
displaying the status of various parts of the
network based on specific criteria such as
alarms, traffic, possible data loss, interfaces, VMs, external events, etc.
H
osts Menu
The Hosts menu provides
options for displaying data
related to hosts, such as
individual host activity, trends
in host behavior, active or
inactive hosts, host user
identity, etc.
Traffic Menu
The Traffic menu allows you to see traffic information broken down in a wide variety
of ways, such as by domain, interfaces, host groups, applications, services, ports,
VMs, etc.
Flows Menu
Just as the name indicates, the Flows menu provides various ways for you to analyze
flows, including network and server performance flow data.
Help Menu
The Help menu contains the SMC Client Online Help and information related to the
version, license, and description of the SMC client software. We will discuss the
advantages of using the online Help in more detail shortly.
Tip:
Click the Refresh button at any time to trigger a data update.
The View Earlier Data button and the View Later Data
The active document is the document you are currently viewing. The title for the
active document is always black and bold. Active documents refresh automatically
based on the corresponding refresh interval. Inactive documents do not refresh
automatically. You must make an inactive document active, and then refresh it
manually. Once a refresh begins, you can navigate to other documents without waiting
for the refresh to finish.
If you hover the cursor over a document tab, you will see a tool tip providing you with
summary information about that document.
Vertical Group
A Flow Table header is shown in the previous example. The header lists the domain
where the involved hosts are located, as well as the host group name. In addition, we
see when the data being presented was captured.
So, the data we are viewing in this example is for flows occurring in the Inside Hosts
host group of the SmokeNet-Alpha domain. The data we are seeing in the document
was captured during the last 12 hours. You can change any of these parameters by
using the filter, which we will discuss momentarily.
Go to Document Buttons
The Go to Document button displays in document headers and tool bars throughout
the SMC client interface. What you see when you click this button depends on the
object associated with the button.
In Document Headers
For example, if you click the Go to Document button next to the host IP address in a
document header, you will see a list of document options that pertain to hosts. If you
click one of those options, the data displayed will pertain only to that specific host.
Likewise, if you click the Go to Document button next to the host group name in the
header, you will see a list of document options that pertain to host groups. If you click
one of those options, the data displayed will pertain only to that specific host group.
In some instances, there is only one document that would pertain to the data you are
viewing. In that case, when you click the Go to Document button, that document will
open immediately.
For example, each component on the
Host Group Dashboard contains its own
tool bar with a Go to Document button.
If you click the button for the Active
High Concern Hosts component, the
SMC will immediately open the
Concern Index document pre-filtered to
shows data that pertains only to the
information being shown in that component on the Host Group Dashboard.
The Concern Index document displays information for hosts that have had the highest
number of CI points since the last archive hour.
When you open the Concern Index document, by default the Concern Index filter
button (located in the upper right corner of the document), is activated, and the
Concern Index shows only those hosts that have active High Concern Index alarms
(i.e., that have a CI percent above 100). To see only hosts that have a CI percent
greater than 50, click the Concern Index filter button.
The label in the pop-up menu (circled in the previous image) indicates the
number of users on which the documents listed below the label are available to
be filtered. If only one name was clicked, then the label indicates the name of
that user.
Note:
You can also open documents by double-clicking items in table cells, and by
using Go to Document buttons.
a specific VM VM Traffic
a specific Cisco ASA exporter The flow table for the last five minutes, filtered
by that ASA
Searching Documents
In addition to searching for items in the Enterprise tree, the SMC allows you to search
through all of its documents (across all domains) for certain items. In the Search field
in the Main Tool Bar, you can search for the following items using a full string, partial
string, or partial string with wild card (*):
Alarm ID
Host or exporter IP address
The following names:
• Exporter
• Host group
• Server
• User
• VM
• VM server
Note:
The search results are limited according to the data role and functional role
associated with your user name.
When you perform a user name search, each user name will appear as a separate item
within a folder entitled “Users” in the Search Results dialog.
Closing Documents
Just as there are multiple ways to open an SMC document, there are several ways to
close them. To close one document, simply click the X in the right corner of the
document tab. Alternatively, from the Main Menu click File > Close, or press Ctrl+W
on your keyboard.
To close all documents, from the Main Menu click File > Close All. You also can
right-click the document tab and select the appropriate option from the pop-up menu.
Note:
For a complete list of keyboard shortcuts that you can use with the SMC, refer to
“Keyboard Shortcuts” on page 91.
Sorting Columns
To sort a column in ascending or descending order, click the Up/Down button in the
column heading. (This button toggles to indicate ascending or descending order.) You
can sort a table by as many as three specific columns. When you sort a single column,
the entire table sorts based on that column. If you sort a second column, the entire
table will sort based on that column first, and will then sort based on the first column
you sorted by, and so on.
In the following example, the first column sorted was the Server Host Groups column,
in ascending alphanumeric order. When the Client Host Groups column was sorted
next, in ascending alphanumeric order, this column became the first column sorted on,
and the Server Host Groups column became the second column sorted on.
By default, column widths are adjusted automatically so that all columns display on
your screen to the greatest extent possible. To widen or shrink the width of a column
manually, click and drag the border of the column heading left or right to the desired
width.
To show more columns, right-click the column heading and select the columns you
want to see from the pop-up menu.
Tip:
To return the table to its default settings, right-click a column heading and select
Reset Table.
Exporting Data
You can save data that appears in any SMC table to a comma-separated-value (CSV)
file. You can then import the CSV file into most spreadsheet programs, such as
Microsoft Excel, for later viewing. You can export all of the information in the table,
or only a specific selection.
To export all of the information in a table, click the Export to CSV button in the
upper right corner of the document, and then click Export All to CSV.
When the Save dialog opens, navigate to the directory where you want to save the
information, and then enter the file name. (You must type .csv at the end of the file
name so that the file is saved in this format.) Click Save. You can now open and view
that information in the spreadsheet program of your choice.
Tip:
You can also right-click any header in a table to access the Export to CSV
options. (The options will appear in the pop-up menu.)
Quick View
The Quick View dialog provides a fast and easy way to view data that appears in a
particular row of a table. Simply click the desired row and press the spacebar on your
keyboard. You can also right-click the row and select Quick View This Row.
In some cases, the Quick View provides navigation to filtered views of other
documents. Right-click within a row to see any pop-up menu with related documents
for more detail on the data in that row.
You can navigate from row to row in the associated document without closing the
Quick View by pressing the Alt key simultaneously with the up or down key on your
keyboard.
You can save any chart as a JPG or PNG file by right-clicking anywhere on the chart
and selecting Save As. You can then import the graphic into another document as
needed for analysis, reporting, or archiving purposes.
Each color on the chart represents a particular application,
service, alarm type, or appliance, depending on the chart you
are viewing. To see details about a particular item on a chart,
hover the cursor over a colored area to see a tool tip with
more information.
Bar and line charts are accompanied by a legend, which lists the various colors and
what they represent. Hovering the cursor over an item in the legend will cause the
associated data points in the chart to be highlighted in red.
As you can see, these elements can take up a lot of space on the document. Since you
can see most applicable information by hovering the cursor over a data point and
looking at the tool tip, you may decide that you don’t need to see the legend and axes.
To hide the legend or the axes, right-
click anywhere on the chart and select
Chart Properties to open the Chart
Properties dialog. For any element that
you do not want to see on the Chart
Properties dialog, click its
corresponding check box to remove the
checkmark.
Use the filter as a funnel to pull only the exact information you want from the vast
amounts of data available from the Stealthwatch system.
You can filter virtually any SMC document. Filtering also allows you to view
historical data, which can be very helpful from a forensic standpoint.
Note:
When you save a document as shared, you also save the filter settings. For more
information about this, refer to “Saving Documents” on page 82.
All SMC documents have filters that operate in much the same way. Let’s take a look
at filtering the information you see on the Flow Table.
Tip:
To investigate flows that
span over multiple days,
use the Flow Traffic
document rather than the
Flow Table for a quicker
response.
Hosts
The Hosts page of the Flow Table Filter allows you to display information for flows
involving only specific hosts.
You can filter for server hosts,
client hosts, or both. You can
narrow your focus to a specific
host group, range of IP addresses,
or a specific IP address. You can
even include VMs and/or exclude
any of these elements.
Tip:
To look for flows involving
any internal host without
showing NATed flows, go to
the Flow Table Filter: Hosts
page and specify that the
broad internal IP Address
Range that your network
uses (e.g., 10.0.0.0/8) is to
be included in the filtering
process.
Ports & Protocols specific IANA-defined protocols, TCP/UDP ports, and/or the ports
used by only clients.
Routing DSCP points, autonomous system numbers, VLAN IDs, and/or MPLS
labels.
Traffic total bytes, total packets, client bytes, client packets, server bytes,
and/or server packets, including specific value ranges, if desired.
Remember, if you have questions about any document, dialog, or filter, you can
always refer to the SMC Client Online Help.
Dashboard Filters
The filters for most SMC documents operate very similarly to the Flow Table Filter.
However, the filters for dashboards are a little different. The Dashboard filters allow
you to filter each component on the associated dashboard. As an example, let’s take a
look at how you can filter information on the Host Group Dashboard.
Note:
Whatever you specify on these three pages of the filter will override selections on
a component filter, as we will see shortly.
Note:
Double-click the title of a
component to rename it
as it appears on the
dashboard.
The Relative and Absolute For the day settings can be useful for documents that you
want to save for future viewing with a particular layout and/or filter savings.
Suppose that under the “For the day” section you click Relative, and then select
Yesterday from the list box. You then save the document as shared. No matter when
you open that document, it will retain Yesterday as the selection. Thus, the document
would always show you data for the day before the current day.
Now, suppose instead that under the “For the day” section you click Absolute, and
then select 1/17/12 from the list box. You then save the document as shared. No matter
when you open that document, it will retain 1/17/12 as the selection. Thus, the
document will always show you the data for that date.
Since you already clicked the Infrastructure host group in the dashboard filter, you
cannot change it on the Hosts page of the component filter. You can only view your
selection.
When finished, click OK to close the component filter and return to the dashboard
filter. When finished making changes, if any, on the dashboard filter, click OK to
refresh the dashboard with the data set you have chosen.
Print Preview
To preview how a document will look before you print it, from the Main Menu select
File > Print Preview. The Print Preview dialog opens.
Print
To print a document, from the Main
Menu select File > Print. The Print
dialog opens.
Note:
For higher quality fonts, set the
path for an external PDF Viewer
(such as Adobe Acrobat
Reader) on the Preferences:
PDF Viewer dialog, which you
can access by selecting Edit >
Preferences from the Main
Menu.
Note:
If you want to make and retain changes to the document layout (such
as change the column positions or change which columns appear),
select File > Use Settings as Default. These changes will be in effect
the next time you open the document.
6. In the Name field, type a name for the document that you can easily recognize.
(The system suggests a name for you.)
7. (Optional) If you want other users to be able to open this document under their
user names, select the Public check box.
Note:
For more information about public documents, refer to “Public
Documents” on page 311 in Chapter 13, “Working with Documents.”
8. (Optional) If you want the document to open automatically every time you log in
to the SMC client interface under your user name, select the “Add this document
to the Login Documents list” check box.
Note:
For more information about login documents, refer to “Login
Documents” on page 306 in Chapter 13, “Working with Documents.”
Note:
By default, only documents saved under your user name appear. To list all
documents, including those created by other users, select the List All Public
check box.
If you access the online Help while a document is active, you will see the Help topic
pertaining to that document. If no documents are open, you will see the introductory
Help topic, “About the Stealthwatch Management Console.”
Note:
You may need to log in using the same credentials you used when you logged in
to the SMC client interface. If you do not see information for the active document,
go back the SMC client interface and press F1 again.
After accessing the SMC Client Online Help, there are several ways to look for
information using the following buttons at the bottom of the left navigation pane:
Contents
Index
Search
Glossary
Favorites
You can also use the Quick Search feature at the top of the topic area to search the open
topic.
Index
The Index pane provides a list of words that you can search
through to find related topics. To view, click Index at the
bottom of the left navigation pane. Click an item in the list to
view that Help topic. You can scroll through the list and make a
selection, or you can type text into the field at the top to go
immediately to that text in the list. Then, make a selection to
view the desired topic.
Search
The Search pane opens by default if no
documents are open when you access the
online Help. Type the text you are seeking in
the field at the top, and then click Search at the
bottom of the left navigation pane or press
Enter on your keyboard. A list of topics
appears, ranked according to relevance to the
text you typed. Click an item to view that topic.
In addition to locating information in general,
this feature can be handy if you need to know
how to open a particular SMC document.
Every Help topic pertaining to a specific
document provides instructions in the first
paragraph on how to access that document.
Glossary
The Glossary pane provides definitions for words that
are commonly used throughout the Stealthwatch
system. To view, click Glossary at the bottom of the
left navigation pane. Click a word in the list to view its
definition.
If you click a Favorite Searches item, the Search pane will open, listing the topics that
pertain to that item. Click an item in the list to view that Help topic.
If you click a Favorite Topics item, that Help topic opens.
To remove an item from the Favorites list, click the corresponding check box to add
a checkmark, and then click the button.
Quick Search
The Quick Search field is located above the Help topic in the Help tool bar.
This field allows you to search for text within the Help topic you are viewing. Simply
type the text in the Quick Search field, and then click the Search button or press
Enter on your keyboard. If the text you typed appears in the topic, it will be
highlighted in yellow, as shown in the following example. To remove the highlighting,
click the Highlighter button.
Note:
We have not discussed all of the documents mentioned in this list, but this will
serve as a handy reference for you as you become more familiar with the SMC.
Press To...
On a chart: Move backward (left) on the zoomed-in
area.
On the Quick View for Flow dialog: Move left from tab
to tab.
On the Quick View for Flow dialog: Move right from tab
to tab.
- continued -
- continued -
- continued -
- continued -
OVERVIEW
Managing all of the hosts in a network individually would be a monumental task.
However, Stealthwatch helps you reduce much of this labor by allowing you to
organize your hosts into host groups.
Host groups offer flexibility in the way you can organize hosts. In general, hosts can
belong to multiple groups. In addition, you can define policies per host group and/or
per host.
In this chapter you will learn how to logically organize hosts into host groups so that
you can monitor different areas of your network and manage host behavior more
efficiently.
This chapter includes the following topics:
Host Groups
Relational Flow Maps
Host Management
© 2017 Cisco Systems, Inc. All Rights Reserved. 97
HOST GROUPS
A host group is essentially a virtual container of multiple host IP addresses or IP
address ranges that have similar attributes, such as location, function, or topology. By
grouping hosts into host groups, you can control how the Stealthwatch Flow
Collectors monitor and respond to the behavior of those hosts as a group, rather than
individually.
Administrators can organize hosts in any way that makes sense for their organization.
With this freedom, reporting and traffic management gain unlimited flexibility. In
addition, policy management is much easier, allowing administrators to set policies
for hosts based on the roles those hosts play in the network.
The SMC client interface displays the host group structure, as well as the network
structure, in the Enterprise tree, as shown in the following example. By default, each
domain contains the following top-level host groups to which you can add subordinate
host groups:
Inside Hosts – Contains all host groups
whose hosts have been specifically defined
as being a part of your network.
Outside Hosts – Contains all host groups
whose hosts have not been specifically
defined as being a part of your network.
Note:
Your login privileges determine whether or not
you see all of the host groups in the Enterprise
tree.
Note:
Although you can create host groups at any level under the Host Groups branch
of the Enterprise tree, we recommend that you add them under the Inside Hosts
or the Outside Hosts branches.
Host Management
98 © 2017 Cisco Systems, Inc. All Rights Reserved.
By default, the Stealthwatch system does not create policies for hosts that are outside
your network. However, if you need to track outside hosts that cause traffic on your
network on a regular basis, you can place them in an Outside Host host group and
establish a policy for the group. Then, you can adjust settings just as you would for
inside hosts.
Note:
You can also create a top-level host group (i.e., at the same level as Inside Hosts
or Outside Hosts) if you have a need to do so for special reporting purposes.
Following are some situations for which you might want to track the behavior of
specific outside hosts:
When you are using outside DNS servers.
When you have third-party consultants or vendors who regularly access
your network.
When you have partner firms that regularly access your network.
Host Management
© 2017 Cisco Systems, Inc. All Rights Reserved. 99
If you have registered any public IP
addresses, we recommend that you
also manually place these ranges in
the Catch All host group. Depending
on your login privileges, you can see
which IP ranges/addresses have
been defined in your Catch All host
group by right-clicking the Catch
All host group in the Enterprise tree
and selecting Configuration > Host
Group Properties.
Notes:
To edit any host group, right-click the host group in the Enterprise tree and select
Configuration > Host Group Properties.
The host name can use alphanumeric characters including the following special
characters: < , > . ? ” ‘ : ; | { [ } ] + = _ - ( ) * & ^ % $ # @ ! ~ ‘ and a “space.”
Ideally, when you finish defining your host group structure, there should be no more
active IP addresses in the Catch All host group. To identify any rogue host IP
addresses, you can look at the Active Hosts document for the Catch All host group.
Simply right-click the Catch All host group in the Enterprise tree, and then select
Hosts > Active Hosts.
Host Management
100 © 2017 Cisco Systems, Inc. All Rights Reserved.
Every network is different, of course, but here are some things to consider when
assigning hosts to the Catch All Host Group:
Which areas within the network are more sensitive than others?
Which areas of the network undergo change frequently vs. those areas that
are fairly stable?
Where are your critical assets?
Which hosts perform similar functions?
What are the different functions that your hosts perform?
Do you have any hosts that are simply quirky and routinely behave
“strangely”?
Note:
To detect URLs in the SLIC Server Feed that may be contacting your hosts, you
must have a FlowSensor or router installed that is configured to export IPFIX (vs.
NetFlow). (By default, the FlowSensor is configured to export IPFIX.).
If you want to investigate a host that has communicated with a malicious host in one
of the previously mentioned host groups, but the malicious host no longer appears in
the relevant host group, go to the Alarm Table and filter on the following components:
Types - Select the applicable bogon, Command & Control, or Tor alarm(s),
depending on which type of malicious host(s) you are wanting to filter on.
Date/Time - Filter according to the time period for which you want to
investigate.
Host Management
© 2017 Cisco Systems, Inc. All Rights Reserved. 101
Note:
The SLIC Threat Feed host group branches cannot be renamed, changed,
moved, or deleted.
Information Reports Up
Any SMC document for a host group includes
information for all hosts within its sub-host
groups. For example, if you open the Host
Information document for the By Function host
group (without changing any of the filter
settings), you will see information about all
hosts in every sub-host group under it, as well
as any hosts defined directly under the By
Function host group.
Host Management
102 © 2017 Cisco Systems, Inc. All Rights Reserved.
2. Right-click either the Inside Hosts or the Outside Hosts host group (whichever
is applicable), and then select Configuration > Add Host Group.
3. In the Name field, type a name for the host group you are adding (e.g.,
Partners).
4. In the Parent field, click the parent for the new host group if the default is not
correct.
5. In the Ranges field, type the desired IP address ranges. Click Import Ranges if
you have an existing file containing the IP addresses for this host group.
6. In the Advanced Policy Options section, click the options that you wish to
apply to the new host group.
7. Click OK to close the Add Host Group dialog. The Enterprise page tree menu
automatically updates to include your new host group.
Host Management
© 2017 Cisco Systems, Inc. All Rights Reserved. 103
IP Addresses
You can use either IPv4 or IPv6 IP addresses to include in each host group. If you
enter IPv4 IP addresses, you must use the forms of notation described in the following
table:
Notation Examples
Single IP address 10.52.1.55
Includes only the host at 10.52.1.55
Note: You must include the trailing period (.) at the end.
10.52-53.
Includes any IP address from 10.52.0.0 to 10.52.255.255, and
from 10.53.0.0 to 10.53.255.255
10.52-55.3.
Includes any IP address from 10.52.3.0 to 10.52.3.255; from
10.53.3.0 to 10.53.3.255; from 10.54.3.0 to 10.54.3.255; and
from 10.55.3.0 to 10.55.3.255
10.52.0.0-10.52.255.255
Includes any IP address from 10.52.0.0 to 10.52.255.255
10.52.100-255.15-255.3
1-2.3-4.5-6.7-8
Host Management
104 © 2017 Cisco Systems, Inc. All Rights Reserved.
If you enter IPv6 IP addresses, you must use the forms of notation described in the
following table.
Notation Examples
Single IP address 2001:0DB8:0000:0056:0000:ABCD:EF12:3456
2001:DB8:0:56:0:ABCD:EF12:3456
2001:DB8::56:0:ABCD:EF12:3456
2001:DB80:0:56::ABCD:EF12:3456
2001:DB80:0:56::ABCD:239.18.52.86
2001:DB8:0:56:ABCD:EF12:3456:1-
2001:DB8:0:56:ABCD:EF12:3456:10
2001:DB8:0:56-58:ABCD-ABCF:EF12:3456:1-10
Host Management
© 2017 Cisco Systems, Inc. All Rights Reserved. 105
Host Group Membership
To see your host group structures, open the Host Group Membership Report.
Generally, you can access this report by right-clicking any element in the Enterprise
tree, then and selecting Reports > Host Group Membership Report.
Host Management
106 © 2017 Cisco Systems, Inc. All Rights Reserved.
RELATIONAL FLOW MAPS
Relational flow maps give you a graphical view of the current state of traffic between
host groups across your network, so you can see immediately where to focus your
attention. Stealthwatch comes with several default maps, which administrators can
customize as needed.
In addition, administrators can easily construct new relationship maps based on any
criteria, such as location, function, or virtual environment, as shown in the following
examples.
Maps help you answer key questions. By creating a relationship between two groups
of hosts, you can analyze the traffic traveling between them. You can double-click a
host group on the map to drill down and gain deeper insight into what is happening.
When the relationship is created, you can right-click the relationship (the line between
host groups), and then select Relationship > Policy to enable the baselining and
alarming functionality between host groups.
Host Management
© 2017 Cisco Systems, Inc. All Rights Reserved. 107
Host Management
108 © 2017 Cisco Systems, Inc. All Rights Reserved.
5
VIEWS AND DASHBOARDS
OVERVIEW
By default, documents in the SMC show you information about every single activity
that is occurring on your network. But, what if you care about only certain types of
traffic or alarms? Or, what if you’d like to view only certain parts of a document rather
than everything on that document? The SMC allows you to build your own dashboard,
thereby permitting you to focus on the primary information you are interested in
viewing.
This chapter includes the following topics:
Default Dashboards in the SMC
Host Group Dashboard
Building Your Own Dashboards
DDoS Traffic Dashboard This dashboard provides information about spikes and
changes in traffic patterns on your network that may
indicate a DDoS attack.
Host Group Dashboard For information about the Host Group dashboard, refer
to “Host Group Dashboard” on page 113.
Note:
For more information about these dashboards, refer to the SMC Client Online
Help.
As you look at the Network page, ask yourself the following questions:
Do the Application graphs show a large amount of traffic for applications
not normally used within your organization?
Do the Application graphs show a large amount of traffic for applications
not normally used at certain times of the day (such as after normal office
hours)?
Do the Application graphs show a significant amount of traffic for the
Undefined or Others applications? If so, you should configure more
application definitions.
Do the Top Active Hosts tables include hosts that should not normally be in
the list of top active hosts?
Do the Top Active Hosts tables show that a small number of hosts are
accounting for extremely large percentages of traffic?
Note:
As you look at the Security page, ask yourself the following questions:
Does the High CI Hosts table show a high concern index for hosts that are
important to your organization?
Does the Alarm Report by Host Group table show high concern index
alarms for sensitive host groups?
Does the Alarm Report by Host Group table show a spike in high concern
index alarms on any particular day?
Does the Top Alarming Hosts table show a large number of alarms for hosts
that are important to your organization?
Does the Top Alarming Hosts table show types of alarms about which you
are particularly concerned?
Does the Top Scans table show a large number of TCP/UDP address scans
for source hosts or target hosts that are important to your organization?
As you look at the Alarms page, ask yourself the following questions:
Do the tables show a large number of alarms for hosts or host groups that are
important to your organization?
Do the tables show types of alarms about which you are particularly
concerned?
I
n the example to the left, we have changed
the name on the page tab from Page 1 to
Security Indices.
5. Click the component you want to add from the left tree menu and drag it to the
area on the page where you want it to be. In the following example, we dragged
the Concern Index component to the left-hand column.
Note how the name of the component has changed from Component to Concern
Index, which is the name of the component we just added. Note also that the
name of the icon in the middle of that column has also changed to the name of
the component we just added.
Notes:
9. Drag components to where you want them on this page, just as you did for the
first page.
10. When you are finished composing your document, click File > Save As to save
it as an XML template on your hard drive.
Note:
The file name will be your document name. For example, if you save
the file name as 1234, your document title will be 1234. Therefore, be
sure to give your document a meaningful file name (e.g., Security
Reports).
13. Click a component you want to filter on and click Edit. The Filter dialog for that
component opens. (The options you are able to filter on will depend on which
button you click on the left side of the dialog).
16. When finished, from the SMC Main Menu select File > Save As to save your
document to the SMC server, enabling you to open it at will in the SMC.
Note:
The file name will be your document name. For example, if you save
the file name as 1234, your document title will be 1234. Therefore, be
sure to give your document a meaningful file name (e.g., Security
Reports).
Note:
You can open previously saved XML and DAR files in the Document
Builder to edit them whenever necessary.
OVERVIEW
Stealthwatch uses indexes to help detect host anomalies on the network. Using
proprietary heuristics and algorithms to establish a baseline of normal behavior for
your environment, the Stealthwatch Flow Collector adds Concern Index (CI) points to
hosts for various unacceptable host behaviors. When the accumulated index points
surpass the acceptable threshold, the Flow Collector raises an alarm.
Indexes help to indicate how anomalous a behavior is, as well as how confident
Stealthwatch is that the anomalous activity is relevant. In other words, indexes help
you prioritize your investigation.
For example, if a stranger rattles your front door and then says he has the wrong
address, you might think that you have no reason to call the police. Your index of
concern would be relatively low. However, if the stranger continues down the street
doing the same thing at your neighbors’ doors, his behavior becomes increasingly
suspicious.
Your index of concern most likely would go up a point (or more) for every door you
see the stranger approach. By the time he approaches the third door, you become
concerned enough to call the police. In this case, the threshold for you to not worry
about this behavior is two doors. At the third door, that threshold is surpassed and you
are compelled to do something about it.
Stealthwatch indexes work in much the same way to protect your network, raising an
alarm only when anomalous activity reaches an unacceptable level. Basically,
anything red on these indexes means that a significant behavior change has occurred.
For example, a single TCP reset will not cause an alarm, even though Stealthwatch
assigns it a CI point. However, numerous TCP resets might cause an alarm, based on
the level defined as acceptable on your system.
Stealthwatch uses the following indexes to track anomalous behavior:
Indexes: Ranking Behavior Changes
© 2017 Cisco Systems, Inc. All Rights Reserved. 123
Concern Index (CI) – Tracks hosts that appear to be performing activities
that could compromise network integrity.
Target Index (TI) – Tracks hosts that appear to be victims of the suspicious
behavior of other hosts.
File Sharing Index (FSI) – Tracks behavior that is indicative of peer-to-peer
(P2P) activity.
1. The Stealthwatch Flow Collector observes the flows in which the host is
involved.
2. The Flow Collector compares the activity to what has been configured as
acceptable behavior.
3. The Flow Collector finds that some of the host’s activities are not acceptable,
and then increases the CI.
Note:
If a host’s activity surpasses its CI threshold, and the High Concern Index alarm
for the associated host group is suppressed, then the Flow Collector will not raise
a High Concern Index alarm against that host.
The Stealthwatch Flow Collector clears all index counts every 24 hours at the
user-defined archive hour. At that time, the Flow Collector saves the log files and
Web files it has gathered during the preceding 24 hours, and then begins another
day of data collection.
The Concern Index document displays information for hosts that have had the highest
number of CI points since the last archive hour.
To display the Concern Index document, right-click a domain or host group and select
Security > Concern Index.
The Concern Index document helps you prioritize threats and focus on the events that
really matter. Instead of seeing thousands of daily alerts, Stealthwatch provides you
with a handful of actionable items in order of severity from highest to lowest.
Note:
An alert is an informational summary of unusual network activity;
however, unlike alarms, alerts are not sent as notifications.
Note:
The accumulated CI for a host is cleared at the archive hour.
Notice that the Concern Index has a Summary section at the top and a Details section
at the bottom. Select a row in the Summary section to see further information about
that row in the Details section.
In the preceding example, the host with the highest threat level is xxx.xxx.238.227.
For purposes of this example, we will assume that this is an inside host. We can easily
see the following information about this host:
Since the last archive hour, this host has accumulated a CI percent of
approximately 824 percent.
This host has also caused two alerts: Ping_Scan, Rejects, TCP_Scan, and
UDP_Scan.
It has received 1.13G of data.
It has sent 71.65M of data.
With the combination of CI percent, alarm, alert, and data transfer, this looks like a
possible security breach. This host should be examined for possible compromise,
misuse, or policy violations.
Double-click the host IP address to open the Host Snapshot for the host that is the
source of the Security Event.
Note:
For descriptions of the various columns that can be viewed in the Concern Index
document, refer to the SMC Client Online Help.
To display the Target Index, right-click a domain or host group and select Security >
Target Index.
Target index values can range from zero points to hundreds of thousands of points. As
target index points accumulate for each host, a TI alarm can result. By default, the data
is sorted by TI percent in descending order. The data represents the greatest data
values that have been observed in the domain since the last archive hour. For example,
a host with a TI percent of 158 has exceeded its TI threshold by 58 percent and may
deserve more investigation. The percentage is followed by a graphic that changes
color when the TI threshold is approached, as described in the following table.
To display the File Sharing Index, right-click a domain or host group, and then select
Security > File Sharing Index.
File sharing index values can range from zero points to hundreds of thousands of
points. As file sharing index points accumulate for each host, an File Sharing Index
alarm can result. By default, the data is sorted by FSI percent in descending order. The
data represents the greatest data values that have been observed in the domain since
the last archive hour. For example, a host with an FSI percent of 158 has exceeded its
FSI threshold by 58 percent and may deserve more investigation.
Percentage of
Text Color
Configured Threshold
0% of configured threshold Empty graphic
OVERVIEW
Stealthwatch uses network behavior analysis to monitor your network and let you
know when changes occur that could indicate potential problems. The system
continually observes every host on your network, recording behavior such as when the
host is more or less active, how much data is being transmitted between hosts, and the
kind of traffic involved.
This chapter describes how to access graphical and tabular data that represents traffic
on your network so that you can see changes in host and network behavior. So, if any
potential threats do exist, you can resolve them before they can inflict harm to your
network.
This chapter includes the following topics:
Monitoring Traffic
Exporters/Network devices
Virtual Machines
Tip:
You can click the Hide Others button to hide traffic for
applications that are not among the top number used. This button
toggles to hide or show the data.
Does the graph show a significant amount of traffic for applications that are
not normally used in your organization?
Does the graph show a significant amount of traffic for the Undefined or
Others applications?
As you look at the Top Internet Destinations, ask yourself the following questions:
Does the table show a significant amount of traffic for peers that should not
be communicating with your organization?
Does the table show peers that are acting as clients and are receiving a
significant amount of traffic from hosts in your organization?
Does the table show peers that are sending/receiving traffic to or from a
large number of hosts in your organization?
As you look at the Current Top Utilized Interfaces, ask yourself the following
questions:
Does the table show any interfaces that are saturated (i.e., are indicating
unusually high percentages of utilization)?
Does the table show any interfaces that should not be included among the
top users?
To navigate directly to a document for an exporter, expand the Network Devices option
under the appropriate host in the Enterprise tree, and then double-click the exporter.
The Interface Status document opens. This document displays statistics for the inter-
faces on routers or switches (i.e., exporters) that are sending data to a Stealthwatch
Flow Collector for sFlow or a Stealthwatch Flow Collector for NetFlow.
Note:
The Interface Status document is not available for the Cisco ASA exporter type.
Click the Filter by Interfaces check box to remove the checkmark. Next, find the
exporter by which the document is currently filtered (it will be the only one with a
check). Click this exporter’s check box to remove the checkmark, and then click OK.
The Interface Status document now shows traffic statistics for the entire domain, as
shown in the following example.
For example, if you select Top > Conversations, the Top Conversations document
will be displayed, as shown in the following example. The Top Conversations
document lists flow data according to the top conversations. The direction (which you
can change in the filter) indicates whether the data includes all traffic (i.e., Total);
traffic inbound to the selected item; traffic outbound from the selected item; or traffic
within the selected item.
Tip:
You can double-click an interface to open a Summary Report.
Note:
You can use this document to find more information about the busiest VMs in
your system. For example, right-click a VM to see other helpful documents filtered
specifically for that VM.
Right-click a VM and
select Traffic > VM
Service Traffic. The
VM Service Traffic
document opens, as
shown in the following
example. This docu-
ment shows both sent
and received traffic
data for the selected
VM according to the
top ten services that were used.
The Top Host document lists flow data according to the top hosts. The direction (which
you can change in the Filter) indicates whether the data includes all traffic (i.e., Total);
traffic inbound to the selected item; traffic outbound from the selected item; or traffic
within the selected item.
Note:
This report requires a Stealthwatch FlowSensor to gather the specific values that
populate this report.
Round-Trip Time
The Round Trip Time tab graphically displays statistics for round trip time for flows.
This feature is useful for measuring the amount of time required for flows to complete
between host groups that are far apart. You can set this up using the Hosts page on the
Filter.
The dark line that is at the bottom of the graph represents the calculated average RTT,
while the tall, thin lines represent the spread between the calculated minimum and
maximum RTT each minute.
The Server Response Time tab graphically displays statistics for server response time
(SRT) for flows.
This feature is useful for measuring the amount of time required for a server to respond
to a request. For example, a user complains that their Web-based application is
performing poorly because screens are “taking forever to populate.” With this docu-
ment, you can observe the server’s SRT and compare the average SRT with the user’s
own SRT from the server.
Note:
This document is available only for domains that have a Stealthwatch Flow
Collector for NetFlow that is receiving data from a Stealthwatch FlowSensor.
Note:
This document is available only for domains that have a Stealthwatch Flow
Collector for NetFlow that is receiving data from a Stealthwatch FlowSensor.
OVERVIEW
You have determined that a specific host has been compromised. You want to “pull
back” conversations to and from that host in order to identify the host suspected of
causing the compromise. Or, you see a high spike in traffic and want to analyze the
data and determine the cause of the spike. Or, an alarm has been triggered and you
need to determine if it is a threat to your network.
The flow analysis process allows you to make these determinations in order to secure
your network. This chapter gives an overview of the flow analysis process and then
walks you through several scenarios of the most common uses.
This chapter includes the following topics:
Flow Filter
Flow Table Tabs
Quick View
Flow Analysis Scenarios
External Lookup
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 153
FLOW FILTER
The Flow Filter dialog allows you to choose the flow data you wish to review and to
set different levels of filtering to receive the desired results.
Note:
It is not necessary to use all the settings described in the following steps.
1. Right-click a domain, appliance, host group, or host IP address, and then select
Flows > Flow Table.
Tip:
If you press Ctrl on the keyboard as you click Flow Table from the pop-up menu,
the filter will display first to enable you to refine the search criteria. After you click
OK, the Flow Table will display using the search criteria you entered.
Analyzing Flows
154 © 2017 Cisco Systems, Inc. All Rights Reserved.
The Flow Table opens.
2. Click the Filter button in the upper left corner of the Flow Table to open the
Filter dialog, and then click the Date/Time icon if it is not already highlighted.
The Date/Time page opens.
3. Specify an exact date/time, range, or relative setting by which to filter the flow
data. For example, if you wanted to show all the flows between midnight and
8:00 AM on a particular day, you would complete the following steps:
a. Click the For the time period option.
b. Click the Starting at option, enter the date you want to filter on, and enter
12:00:00 in the time field.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 155
c. Click the and ending at option, enter the date you want to filter on, and enter
08:00:00 in the time field for that option.
Analyzing Flows
156 © 2017 Cisco Systems, Inc. All Rights Reserved.
4. Click the Hosts icon. The Hosts page opens.
Specify the hosts by which you want to filter the flow data. You can include/
exclude a host group, one or more VMs, a range of IP addresses (using CIDR
format), or a list of IP addresses (in comma-separated format).
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 157
5. Click the Identity icon. The Identity page opens.
Specify the user names by which you want to filter the flow data by completing the
following steps:
1. Click the Client User Name check box to insert a check mark.
2. Type any of the following content in the text field:
A single user name, such as jdoe.
Multiple user names, such as jdoe, jalpha, jbeta. You can type the names,
separating each name with a comma or pressing Enter after each name (to
enter one name per line). You can also copy and paste from a comma-
separated value (CSV) list of names.
Partial name(s) with wild cards. The wild card can be in any position, such
as srh*, *doe. You can use more than one wild card in each name.
Notes:
This field is not case sensitive.
A user name cannot contain any of these characters: | + = ? “ < > ( ) : ;
Analyzing Flows
158 © 2017 Cisco Systems, Inc. All Rights Reserved.
3. Click OK.
The results are displayed in the Client User Name column. If you have filtered
on only one user, that user’s name will display in the header. If you have filtered
on more than one user, the header displays the number of user names you have
filtered on. If you hover your cursor over this entry, the names of the first ten
users you have queried are listed in a pop-up window (refer to the screen
below).
The number of user names filtered on in addition to the first ten is displayed at
the bottom of the pop-up window. In the example below, 14 user names have
been filtered on, so at the bottom of the pop-up window the entry 4 more...
appears.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 159
4. Click the Interfaces icon. The Interfaces page opens.
Specify the interfaces by which you want to filter the flow data. You can click
individual interfaces, an entire exporter, or a Stealthwatch appliance.
Analyzing Flows
160 © 2017 Cisco Systems, Inc. All Rights Reserved.
5. Click the Services & Applications icon. The Services & Applications page
opens.
Specify the services or applications by which you want to filter the flow data by
clicking one or both of the following check boxes to add a check mark(s):
Filter by Services
Filter by Applications
Click either the Include or Exclude option. For example, you may wish to limit
your query to everything except Facebook. In that case, you would click the Fil-
ter by Applications check box to add a check mark, click the Exclude option,
and then click the Facebook check box to add a check mark.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 161
6. Click the Ports & Protocols icon. The Ports & Protocols page opens.
Specify the ports and protocols by which you want to filter the flow data by
clicking any or all of the following check boxes to add a check mark(s):
Filter by Protocols
Filter by TCP/UDP Ports
Filter by Client Ports
Click either the Include or Exclude option to further customize your query.
Analyzing Flows
162 © 2017 Cisco Systems, Inc. All Rights Reserved.
7. Click the Routing icon. The Routing page opens.
Specify the parameters by which you want to filter the flow data by clicking any
or all of the following check boxes to add a check mark(s):
Filter by DSCPs
Filter by AS Number
Filter by VLAN ID
Filter by MPLS Label
Click either the Include or Exclude option to further customize your query.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 163
8. Click the Traffic icon. The Traffic page opens.
Specify the type and size of traffic data by which you want to filter the flow
data.
Analyzing Flows
164 © 2017 Cisco Systems, Inc. All Rights Reserved.
9. Click the Performance icon. The Performance page opens.
Specify the type and size of performance data by which you want to filter the
flow data.
Note:
All values on the Performance page require a Stealthwatch FlowSensor to collect
and store this information.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 165
10. Click the Application Details icon. The Application Details page opens.
Specify the payload information by which you want to filter the flow data.
Analyzing Flows
166 © 2017 Cisco Systems, Inc. All Rights Reserved.
11. Click the Advanced icon. The Advanced page opens.
You can limit the query to a maximum number of flow records. You can also
specify how the data will be sorted (e.g., on the server, before the data is pulled)
and whether or not duplicate flows will be removed from the results.
Notes:
The Remove duplicate flows option is only relevant if there are
multiple Flow Collectors. A single Flow Collector automatically de-
duplicates.
If you do not need to view interface data, click the Include interface
data check box to remove the check mark. This allows for quicker data
retrieval.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 167
12. Click OK when you are ready to perform the filtering. The flow query is sent,
and the retrieved data appears in the Flow Table document.
The next time you access the Flow Table, only the filter settings you have
specified on the Advanced page will still be in effect. No filter settings on any other
pages in the Flow Table filter will be retained.
Analyzing Flows
168 © 2017 Cisco Systems, Inc. All Rights Reserved.
FLOW TABLE TABS
Table Tab
The Table tab on the Flow Table document displays data for flows based on the
options you specified on the Flow Table Filter.
Note:
You can click the Go to Document button in the upper right corner of the
document to display other documents using the same flow data.
Because imported flow files do not include the original appliance/domain information,
pop-up menu options that require this information are not available (they are grayed
out) for imported flow files.
Note:
For more information about importing flow files, refer to the “How to Import a Flow
File” topic in the SMC Client Online Help.
To change the columns displayed in the table, right-click a heading and select the
desired columns from the pop-up menu. A heading with a check mark next to its name
indicates that it will be displayed in the document.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 169
Short List Tab
The Short List tab shares the same configuration as the Table tab. Changes made on
one are automatically reflected on the other.
The Short List tab on the Flow Table document allows you to display a subset of the
flow data that appears on the Flow Table: Table page. For example, the Table tab may
show thousands of records of flows, but you may want to view only a small number of
those rows for closer analysis. The Short List feature allows you to select specific
rows for easier viewing.
Analyzing Flows
170 © 2017 Cisco Systems, Inc. All Rights Reserved.
Only the data for the hosts in the Short List appears, rather than all the data that was
retrieved by the Flow Table Filter.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 171
QUICK VIEW
The Quick View dialog provides a quick and easy way to view tabular data
graphically. It also provides quick navigation to filtered views of other documents.
To see the Quick View dialog, click a table cell, and then press the Spacebar. To make
the dialog disappear, press the Spacebar again or the Esc key.
As shown in the example below, the Quick View dialog shows data on the following
tabs:
General
Interfaces
Table
You can navigate from tab to tab by pressing the key together with the or
key on your keyboard.
You can navigate from flow to flow (while keeping the Quick View dialog open) by
pressing the key together with the or key on your keyboard.
Tip:
The same navigation features (e.g., drilling down to other documents) that apply
to other tables apply here as well.
Analyzing Flows
172 © 2017 Cisco Systems, Inc. All Rights Reserved.
FLOW ANALYSIS SCENARIOS
Now that you are familiar with the flow analysis process, we will walk you through
several common scenarios.
Workflow Overview
The following steps provide an overview of the procedures illustrated in the preceding
workflow diagram.
1. Open the Host Snapshot: Security Events page for the source host and review
the details. Refer to the following section, “Examining Security Event Activity
(Host Snapshot).”
2. Click the Identity, DHCP & Host Notes tab.
3. Can you identify the user?
If yes, go to step 4.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 173
If no, go to step 6.
4. Review the information of any users logged in to the source host. Refer to
“Examining User Identity Information (Host Snapshot)” on page 176.
5. Based on the information you have gathered, does this activity appear to be a
genuine concern?
If yes or if you are unsure, go to step 6.
If no, stop here.
6. Create a PDF of the Host Snapshot and escalate according to your organization’s
standard escalation procedure.
This workflow starts the investigation from the Host Group Dashboard: Security page.
Complete the following steps to examine the Security Event activity of a High CI host.
1. On the Host Group Dashboard, click the Security tab. In the Active High Con-
cern Hosts and the Active High Target Hosts sections, the High CI hosts and
High TI hosts are listed for the host group associated with that particular Host
Group Dashboard.
Analyzing Flows
174 © 2017 Cisco Systems, Inc. All Rights Reserved.
2. Double-click the appropriate host IP address to open its Host Snapshot.
Tip:
If you know the IP address, you also can find the Host Snapshot by
using the global Search function.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 175
Note:
Refer to the “Security Events” topic in the SMC Client Online Help for
detailed descriptions of specific Security Events.
Analyzing Flows
176 © 2017 Cisco Systems, Inc. All Rights Reserved.
Which user(s) have logged in to this host?
How long have they been logged in?
What is the user’s MAC address?
4. Based on the information you have gathered about this host, does this activity
appear to be a genuine concern?
If yes, or if you are unsure, go to step 5.
If no, stop here.
5. Create a PDF of the Host Snapshot and escalate according to your organization’s
standard escalation procedure.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 177
Workflow Overview
The SMC provides several places where you can see traffic spikes, such as the
following:
Any traffic graph that you can access via the Traffic menu.
Host Group Dashboard: Network page
This workflow starts the investigation from the Network page. The following steps
provide an overview of the procedures illustrated in the preceding workflow diagram.
1. On the Network page, determine in which direction the traffic spike is going.
Refer to “Identifying the Hosts Involved” on page 180.
2. Double-click that traffic spike to open the Top Conversations document, and
then identify which host pair is using the most bandwidth in the noted direction.
Refer to “Identifying the Hosts Involved” on page 180.
3. Review the following questions regarding the host pair identified above:
Are there any unexpected connections (e.g., unauthorized host groups or
servers)?
Are there a large number of unexpected connections?
What ports are being used?
Are there large amounts of traffic being sent and/or received?
Are there any connections with high bps rates?
Does this spike correlate with user complaints about the network?
4. Open the Host Snapshot: Identity, DHCP & Host Notes page for the peer. Refer
to “Identifying the Users Involved” on page 180.
5. Can you identify the user involved?
If yes, go to step 8.
If no, go to step 6.
6. Open the Host Snapshot: Identity, DHCP & Host Notes page for the host. Refer
to “Identifying the Users Involved” on page 180.
7. Can you identify the user involved?
If yes, go to step 8.
If no, go to step 9.
9. Gather the information you have collected thus far and escalate according to
your organization’s standard escalation procedure.
Analyzing Flows
178 © 2017 Cisco Systems, Inc. All Rights Reserved.
Identifying the Direction of Traffic
The Host Group Dashboard provides the most comprehensive view of host group
application traffic on its Network tab.
Look at the Application Traffic Inbound (+) and Outbound (-) and the Application
Traffic Within charts to immediately see if you have a spike in traffic, and to
determine in which direction that traffic is traveling.
The Application Traffic Inbound (+) and Outbound (-) chart shows traffic traveling
into the Inside Host Groups from the Outside Host Groups and vice versa. Inbound
traffic appears above the zero (0) line. Outbound traffic appears below the zero line.
The Application Traffic Within chart shows traffic that is traveling only between the
subhost groups within the network (Inside Host Groups).
Each chart displays the top 15 applications used over the time period set in the filter. A
different color represents each application. The legend for each chart lists the services
in order from the most used to the least used. Hover the cursor over an application in
the legend to see that application highlighted in the chart.
Hover the cursor over a data point on the chart to
display a tool tip that provides details about that
traffic, as shown in the example to the right.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 179
Double-click a data point to display a pop-up
menu that allows you to choose from several
options to learn more about that traffic, as
shown in the example to the left.
2. Identify the host and the peer that are using the highest percentage of bytes. (By
default, this is represented by the number 1 in the # column.)
3. Review the following questions regarding the host pair identified above:
Are there any unexpected connections (e.g., unauthorized host groups or
servers)?
Are there a large number of unexpected connections?
What ports are being used?
Are there large amounts of traffic being sent and/or received?
Are there any connections with high bps rates?
Does this spike correlate with user complaints about the network?
Analyzing Flows
180 © 2017 Cisco Systems, Inc. All Rights Reserved.
2. Click the Identity, DHCP & Host Notes tab.
8. Gather the information you have collected thus far and escalate according to
your organization’s standard escalation procedure.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 181
Overloaded Interface
If you know or suspect that an interface has become overloaded or is close to capacity,
you can use the workflow shown in the following diagram to help pinpoint the source
of the problem.
Workflow Overview
The SMC provides several places, including the following, where you can easily see
interface utilization:
Network Devices within the Enterprise tree
Interface Status
Alarm Table (if an Interface Utilization Exceeded alarm was triggered)
This workflow starts the investigation from the Interface Status document. The
following steps provide an overview of the procedures illustrated in the preceding
workflow diagram.
1. Open the Interface Status document for the domain to identify the overloaded
interface. Refer to the following section, “Identifying an Overloaded Interface
(Interface Status).”
2. Open the Interface Summary Dashboard for the over-utilized interface and look
at the Top Active Conversations.
Analyzing Flows
182 © 2017 Cisco Systems, Inc. All Rights Reserved.
3. Note the IP addresses of the host pair (host and peer) consuming the most
bandwidth.
4. Open the Host Snapshot: Identity, DHCP & Host Notes page for the host. Refer
to “Identifying Users Logged In to a High Bandwidth Host” on page 190.
5. Can you identify the user?
If yes, go to step 8.
If no, go to step 6.
6. Open the Host Snapshot: Identity, DHCP & Host Notes page for the peer. Refer
to “Identifying Users Logged In to a High Bandwidth Host” on page 190.
7. Can you identify the user?
If yes, go to step 8.
If no, go to step 10.
8. Contact the user and determine if the activity in which the user is engaged is
legitimate.
9. Is the activity legitimate?
If yes, stop here.
If no, go to step 10.
10. Gather the information you have collected thus far and escalate according to
your organization’s standard escalation procedure.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 183
the following example. (Hint: Look for red, orange, or yellow bars in the
Current Utilization and Maximum Utilization columns.)
Analyzing Flows
184 © 2017 Cisco Systems, Inc. All Rights Reserved.
Network Slow
One of the most common user complaints is that the network is slow. The following
diagram shows a workflow you can use to help pinpoint the source of the problem.
Workflow Overview
The following steps provide an overview of the procedures illustrated in the preceding
workflow diagram.
1. Do you have the complaining user’s IP address?
If yes, go to step 3.
If no, go to step 2.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 185
If yes, use the User Identity filter to search for the user’s IP address. Refer to
the following section, “Using the Stealthwatch IDentity to Locate an IP
Address.”
If no, use any tool (e.g., ipconfig) you have available to obtain the user’s IP
address.
3. Open the Host Snapshot: Exporter Interfaces page for the user’s IP address.
Refer to “Checking for Over-Utilized Interfaces (Host Snapshot)” on page 188.
4. Are any interfaces over-utilized or close to capacity?
If yes, open the Interface Summary Dashboard for the over-utilized interface
and look at the Top Active Conversations. Refer to “Finding High Bandwidth
Hosts (Interface Summary Dashboard)” on page 190.
If no, go to step 8.
5. Note the IP addresses of the host pair (host and peer) consuming the most
bandwidth.
6. Based on which host pair interests you the most, open the Host Snapshot:
Identity, DHCP & Host Notes page for either the host or the peer to try to
identify the user(s) logged in to that IP address. Refer to “Identifying Users
Logged In to a High Bandwidth Host” on page 190.
7. Can you identify the user(s)?
If yes, obtain the user’s IP address and go to step 8.
If no, go to step 10.
8. Open the associated Host Snapshot: Top Active Flows page and review the
details of the flows associated with the user to potentially determine the cause of
the issue. Refer to “Reviewing Top Active Flows” on page 191.
9. Were you able to resolve the issue?
If yes, stop here.
If no, go to step 10.
10. Gather the information you have collected thus far and escalate according to
your organization’s standard escalation procedure.
Analyzing Flows
186 © 2017 Cisco Systems, Inc. All Rights Reserved.
2. Right-click the IDentity appliance and select Hosts > User Identity.
The Filter dialog: User Identity page opens. The domain and device you chose
are automatically selected on the Domain/Device page.
Notes:
The filter opens to the last page you viewed the last time you closed
the filter. If you have never opened the filter, it will open to the Domain/
Device page.
To look through all IDentity appliances for the user’s IP address, click
the Filter by Devices check box on the Domain/Device page to
remove the check mark.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 187
4. Click the Filter on User Name check box to add a check mark, and then type
the user’s login name in the User Name field.
5. By default, the filter looks only for the IP addresses of users who are logged in at
the time of the query, as indicated by the selected Filter on currently Logged
In/Out options.
To search for IP addresses that a user was logged in to at other times, click the
Filter on currently Logged In/Out check box to remove the check mark, and
then go to the Date/Time page of the filter to specify the time frame in question.
6. If desired, change the number of records that display by typing over the value in
the Limit the number of User Identity records returned to field.
Note:
For troubleshooting the type of issue described in this section, you
generally do not need to define any other parameters in the filter. If
you need additional assistance, refer to the SMC Client Online Help.
7. Click OK. The User Identity document opens, displaying the IP addresses
associated with the specified user name.
Tip:
Double-click the IP address to open the associated Host Snapshot.
Analyzing Flows
188 © 2017 Cisco Systems, Inc. All Rights Reserved.
1. Did you use the User Identity document to locate the IP address?
If yes, double-click the IP address to open the Host Snapshot, and then go to
step 4.
If no, go to step 2.
Tip:
Hover the cursor over a value in the Current Utilization column to see
capacity availability and usage details for the associated interface.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 189
5. Are any interfaces overloaded or close to capacity? (Hint: Look for red, orange,
or yellow bars in the Current Utilization column.)
If yes, open the Interface Summary Dashboard for the overloaded interface to
determine why there is so much traffic. Refer to the following section,
“Finding High Bandwidth Hosts (Interface Summary Dashboard).”
If no, click the Top Active Flows tab on the Host Snapshot and review the
details of the flows associated with the user to potentially determine the cause
of the issue. Refer to “Reviewing Top Active Flows” on page 191.
Look at the right side of the dashboard to see the Top Active Conversations Inbound
and Outbound. Identify the host pairs (host and peer) that are using the most
bandwidth (see the Bytes column) in either direction.
To identify the users logged in to each of those IP addresses, open the Host Snapshot:
Identity, DHCP & Host Notes tab for each IP address. Refer to “Identifying Users
Logged In to a High Bandwidth Host” on page 190.
Analyzing Flows
190 © 2017 Cisco Systems, Inc. All Rights Reserved.
If login information is available, you will see the user name for any user logged in to
that IP address.
If no user information is available, gather the information you have collected thus far
and escalate according to your organization’s standard escalation procedure.
Tip:
If you have a Stealthwatch IDentity appliance, you can double-click
the user name to open the User Identity document and to see the IP
addresses associated with that user.
First, look at the RTT and SRT values. If the SRT is unacceptably high, you know that
the problem lies with the server, and you can then contact the server team to resolve
the problem.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 191
If the SRT value is fine, the issue lies somewhere in the network, most likely with the
host itself. Review the following questions as you look at the Top Active Flows tab.
The answers may help you determine if the host has been hijacked or infected with
malware, or if the user is engaging in unauthorized activity.
1. Are there any unexpected connections (e.g., unauthorized host groups or serv-
ers)?
2. Are there a large number of unexpected connections?
3. What services are being used?
4. Are there large amounts of traffic being sent and/or received?
5. Are there any connections with high bps rates?
6. Has the host changed roles from being a client to being a server? If a workstation
suddenly starts running as a server, most likely it is infected with malware or has
been hijacked.
Analyzing Flows
192 © 2017 Cisco Systems, Inc. All Rights Reserved.
If you are unable to resolve the issue based on the answers to the previous questions,
complete the following steps:
1. Make sure the host’s antivirus program or firewall isn’t blocking access to the
server in question.
2. Because the host’s antivirus program may have failed to detect malware and
may be compromised, run a virus scan on the host using another antivirus
program, such as Malwarebytes’ Anti-Malware.
3. Find out if any new applications have been installed or updated on the host. If
so, verify that the application has been properly configured. You may need to
uninstall the application, and then reinstall it.
If you are unable to resolve the issue using these suggestions, gather the information
you have collected thus far and escalate according to your organization’s standard
escalation procedure.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 193
EXTERNAL LOOKUP
The External Lookup feature allows you to launch a Web application (or internal asset
database) to view additional information about an IP address. You can launch this Web
application or database directly from the Stealthwatch Management Console (SMC)
client interface or the SMC Web App interface.
You can also use the External Lookup feature to create shortcuts that enable you to
jump quickly from the SMC client interface to the SMC Web App interface.
The Stealthwatch System includes the following default Web applications (lookup
options) for use with the External Lookup feature; you do not have to add them to the
Stealthwatch System:
Cisco SenderBase
DShield
Host Report
Some examples of Web applications that a Stealthwatch System administrator can add
to view additional information about an IP address include the following:
BigFix
CiscoWorks
Cisco Identity Services Engine (ISE)
Splunk
Tripwire
Ziften
Important:
To add a non-default lookup option, you must use the External Lookup
Configuration tool in the SMC Web App interface. For information about how to
do this, refer to "Configuring External Lookup."
Analyzing Flows
194 © 2017 Cisco Systems, Inc. All Rights Reserved.
add it to the Stealthwatch System. To do this, use the External Lookup Configuration
tool in the SMC Web App interface.
Notes:
When upgrading to v6.7, for each external lookup option that you previously
added, you will now have two in v6.7.
The Stealthwatch System no longer uses webLinks.xml files to manage external
lookup configuration.
With this tool you can also configure the specific parameters that you want to send to
a Web application. The parameters you configure are only sent if they are available for
the IP address on which you are performing the lookup.
To add a lookup option and configure the parameters that you want to send to the Web
application, complete the following steps:
1. In the SMC Web App interface, in the left Navigation pane, click Tools > Set-
tings > External Lookup Configuration. The External Lookup Configuration
page opens.
To disable a lookup option so that it is not available for use with the External
Lookup feature (but to retain its configuration for later use), click Enabled in
the applicable row. The button toggles to show the status of Disabled.
To enable this lookup option in the future, click Disabled. The button toggles to
show the status of Enabled.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 195
3. In the top part of this section, type the applicable entries in the following fields:
Name
Base URL
4. To view information about internal IP addresses in a Web application, ensure
you select the “Enable lookup of internal IP addresses” check box.
5. In the Query Parameter Mapping section, in the first Stealthwatch Attribute
Name field, select Source IP Address or Target IP Address.
Important:
You must configure either a source IP address or target IP address for
any lookup option that you add.
Note:
You can map up to 20 query parameters for each lookup option.
Analyzing Flows
196 © 2017 Cisco Systems, Inc. All Rights Reserved.
9. If your query parameters do not match the standard query parameters, then you
must upload your customized script builder configuration into the URL Script
Builder File Upload field.
Note:
Ensure you use the variables highlighted in the following script
examples.
The script builder file contains the script that configures the query parameters
into the URL format that the Web application requires in order to run a query.
If you do not upload a script builder file, the Stealthwatch System will use the
default standard query parameters shown below.
BaseURL?[ParameterName1]=[ParameterValue1]&
ParameterName2]=[ParameterValue2]&
ParameterName3]=[ParameterValue3] (and so on for
each parameter you add)
URL and script examples
Example 1
The following URL and script example are used for Web applications that use
values without parameter names (e.g., Splunk).
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 197
To build the script that configures the query parameters into the URL format
shown previously in this example, use the Parameter Name field entry high-
lighted in the image below.
Note:
You can configure as many attributes as you need; however, ensure that you
configure the same number of parameters.
Analyzing Flows
198 © 2017 Cisco Systems, Inc. All Rights Reserved.
Example 2
The following URL and script example are used for Web applications that use
rest-like path parameters (e.g., Stealthwatch Host Report).
To build the script that configures the query parameters into the URL format
shown previously in this example, use the Parameter Name field entry high-
lighted in the image below.
10. When you finish, click Save. You are returned to the External Lookup section.
The lookup option you just added is now displayed on the list and is enabled by
default (it is available for use with the External Lookup feature).
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 199
Performing an External Lookup
To query a Web application to view additional information about an IP address,
complete the following steps:
1. Do one of the following:
If you are in the SMC client interface, go to step 2.
If you are in the SMC Web App interface, go to step 3.
2. Complete the following steps:
a. In the SMC client interface, open any document that contains the relevant IP
address.
b. Right-click the IP address.
c. In the pop-up menu that appears, click External Lookup. A secondary pop-
up menu appears.
Analyzing Flows
200 © 2017 Cisco Systems, Inc. All Rights Reserved.
c. In the pop-up menu that appears, click External Lookup. A secondary pop-
up menu appears.
4. Click the desired lookup option from the secondary pop-up menu shown in step
3. The Web application for the lookup option you selected opens (you may be
prompted to log in to the Web application) and displays the query results for the
IP address on which you are performing the lookup.
Every parameter you designate to be required for a specific Web application
must be available for the IP address on which you are performing a lookup. If
one or more of the required parameters are not available for the relevant IP
address, that lookup option will not be enabled in the pop-up menu. For more
information, refer to “Configuring Vendors” on page 194.
Analyzing Flows
© 2017 Cisco Systems, Inc. All Rights Reserved. 201
Following is an example of the information returned for a query using the
DShield Web application.
Analyzing Flows
202 © 2017 Cisco Systems, Inc. All Rights Reserved.
9
SLIC THREAT FEED SERVICE
OVERVIEW
The Stealthwatch Labs Intelligence Center (SLIC) Threat Feed is a service from
Lancope that delivers frequently updated information about threats to your network.
The SLIC Threat Feed provides data about malware Command and Control (C&C)
servers and other hosts of interest (e.g., bogons, Tor) that Stealthwatch uses to rapidly
and accurately identify harmful network activity.
This chapter includes the following topics:
About the SLIC Threat Feed
Prerequisites
How the SLIC Threat Feed Functions
Enabling the SLIC Threat Feed
Disabling the SLIC Threat Feed
SLIC Security Events
Note:
The Threat Feed can connect to the Internet through a proxy server. If
you require a proxy server to access the Internet, open the Appliance
Administration (Admin) interface and then click Configuration >
Services to configure your proxy server. For more information, refer to
the Stealthwatch System Hardware Configuration Guide, the
configuration guide for the applicable appliance, or the Appliance
Administration Online Help.
The SLIC Threat Feed must be enabled in the SMC client interface.
The SMC license must include the SLIC Threat Feed.
A warning dialog displays when there are less than 15 days remaining until the license
expires. After the license expires, the following occurs:
The SMC disables the SLIC Threat Feed.
The Bogon, Command & Control Servers, and Tor host group branches in
the Enterprise tree become dimmed and the SLIC Threat Feed will no longer
provide dynamic information (feeds).
The SMC client interface displays a message stating that this feature cannot
be enabled because the license does not allow connection to the SLIC Threat
Feed.
Note:
For information about the alarms these security events can trigger (if
configured to do so) and the conditions that must exist before each
one is raised, refer to “SLIC Security Events” on page 211.
5. If the SLIC Threat Feed has been enabled in the SMC, but the SMC server is not
able to retrieve data from the SLIC Threat Feed, the SLIC Channel Down alarm
is triggered. The SLIC icon in the Enterprise tree turns gray and an X appears at
the bottom of the icon.
This alarm clears when either of the following two conditions is true:
The SMC server begins retrieving data from the SLIC Threat Feed again.
You disable the SLIC Threat Feed.
Note:
The SLIC Threat Feed host group branches cannot be renamed, changed,
moved, or deleted.
The SLIC Threat Feed contains IP addresses, port numbers, protocols, host names,
and URLs known to be used for malicious activity. The following host groups are
included in the SLIC Threat Feed:
Bogon - A bogon is an IP address that has not been officially assigned on the
public Internet.
Note:
To detect URLs in the SLIC Server Feed that may be contacting your hosts, you
must have a FlowSensor or router installed that is configured to export IPFIX (vs.
NetFlow). (By default, the FlowSensor is configured to export IPFIX.).
If you want to investigate a host that has communicated with a malicious host in one
of the previously mentioned host groups, but the malicious host no longer appears in
the relevant host group, go to the Alarm Table and filter on the following components:
Types - Select the applicable bogon, Command & Control, or Tor alarm(s),
depending on which type of malicious host(s) you are wanting to filter on.
Date/Time - Filter according to the time period for which you want to
investigate.
Note:
For more information, refer to the Stealthwatch System Hardware
Configuration Guide, the configuration guide for the applicable
appliance, or the Appliance Administration Online Help.
2. In the SMC client interface, in the Enterprise tree, right-click the StealthLabs
Intelligence Center branch and select Configuration > SLIC Threat Feed
Configuration.
The SLIC Threat Feed Configuration dialog opens.
Note:
If you are not licensed for the SLIC Threat Feed feature, the SLIC Threat Feed
Configuration dialog will not display. Instead, you will receive a message stating
that you are not licensed for this feature.
5. If desired, change the SLIC Feed Confidence Setting. By adjusting the SLIC
Feed Confidence Setting, you can select the confidence threshold that
Stealthwatch will require when matching against a host on the SLIC Threat
Feed.
Lower the threshold value if you can accept a greater number of false positives
in order to see a greater number of threats (a lower number signifies a lower con-
fidence rating). Raise the value if you want fewer false positives at the expense
of seeing a lower number of potential threats. By default this is set to 7.
6. Click OK. The following host group branches
are displayed in the Enterprise tree:
Bogon
Command & Control Servers
Tor
Note:
It may take up to a minute for these lists to display in the tree after you
click OK.
2. Select the "Enable the SLIC Threat Feed" check box to clear it. The entry in the
SLIC Threat Feed Key field becomes dimmed.
Note:
If you choose to enable the SLIC Threat Feed in the future, simply
click the “Enable the SLIC Threat Feed” check box to add a
checkmark. You do not need to re-enter the SLIC Threat Feed key.
3. Click OK.
Bot Infected Host – This alarm indicates that a host in your network has
Successful C&C communicated with a C&C server that appears on the
Activity C&C Servers list, has received a response, and is
therefore now a member of a botnet. The C&C server may
be either inside or outside of your network.
Communication is two-way.
Bot Command & This alarm indicates that a host inside your network is
Control Server functioning as a C&C server of a botnet. This alarm is
triggered when an inside host on your network matches an
IP address that the SLIC Threat Feed has identified as a
C&C server. This alarm identifies only the source IP
address. Targets are not identified.
Connection from Tor One or more of the hosts on your network are receiving
Successful traffic from a current Tor network exit node. Tor is an
Internet anonymization service.
Connection to Tor One or more of the hosts on your network are sending
Successful traffic to the Tor network. Tor is an Internet anonymization
service.
Inside Tor Entry One of your active inside hosts is acting as a Tor entry
Detected node. Tor is an Internet anonymization service.
Inside Tor Exit One of your active inside hosts is acting as a Tor exit
Detected node. Tor is an Internet anonymization service.
Note:
For additional information about these alarms, refer to the “Alarm List” topic in the
SMC Client Online Help.
OVERVIEW
As you have learned, the first step in handling a threat is to find out which host is
causing the alarm (i.e., the “source host”). This chapter describes how you can use the
SMC to gather information about the source host so that you can make an informed
decision as to how to handle the threat.
This chapter includes the following topics:
Identification Process
Alarm Summary
Alarm Table
Global Search
Note:
Keep a record of hosts that have caused trouble on your network so you can
easily determine if you have a “repeat offender.”
To navigate from this document, you can perform any of the following actions:
To see the Host Snapshot, double-click a host IP address on the Hosts tab.
To get a filtered view of the Alarm Table, double-click the Alarm Count or
Alarm Types column.
For example, if you double-click the High Concern Index alarm in the
Alarm Types column, the Alarm Table will display only High Concern
Index alarms.
Note:
For a description of each alarm, refer to the SMC Client Online Help.
Like most SMC documents, the Alarm Table displays data that corresponds to the
level at which you open the document. For example, if you open the Alarm Table at
the domain level, the alarms it displays will pertain to the domain as a whole. If you
open the Alarm Table at the host group level, the alarms it displays will pertain to only
the host group and its sub-host groups.
In addition to viewing alarms, the Alarm Table allows you to acknowledge, close, and
add notes to alarms (depending on your login privileges). You can click an alarm, and
then click the Flow Table button to display the Flow Table with all the flows
associated with that alarm.
An alarm remains active until the condition that caused the alarm no longer exists.
Then, the alarm becomes inactive, at which point you can close it, if desired. You can
Note:
For more information about responding to alarms, refer to Chapter 11,
“Responding to Alarms.”
Note:
The search results are limited according to the data role and functional role
associated with your user name.
Tip:
You can use the Search drop-down list box to select an item that you have
previously searched for and then press Enter to execute the search.
To perform a search, click inside the Global Search box in the tool bar.
In most cases, you can simply double-click a host’s IP address anywhere in the SMC
client interface to see the Host Snapshot for that host. The Host Snapshot includes the
following information:
The most recent flows associated with the host.
The flows with the highest amount of traffic so far today.
The username(s) of anyone who has logged into the host.
Any alarms associated with the host.
Which exporter interfaces are carrying the flow.
The organization to which the host IP address is assigned, along with the
address and Internet Service Provider (ISP), if applicable.
The host’s status and when it was last seen communicating on the network.
The host’s server/client profile(s) and operating system (OS), as well as any
alerts associated with the host.
The more alarms a host causes, the more concerned you should be. Remember, the
level of severity is configurable so that it can adjust to your particular situation.
In the preceding example, we see the following information about the selected host:
The Alarm Counts table displays the number of alarms caused by the
selected host as reported by the corresponding Stealthwatch appliances,
based on the alarm type and category. In this example, the Stealthwatch
appliances reported 11 minor alarm conditions and 5 major alarm
conditions.
Note:
You can right-click the column headings and select the columns for
the specific alarm types you want to show in the table.
The Alarms table displays detailed data about the individual alarms
generated by the selected host since the last archive hour. In this case, we
see that this host has generated several Worm Activity alarms.
Note:
You can open the Host Policy Manager to see and/or adjust the policy
settings established for these values.
Since we suspect that this host may be infected, our next step is to identify the source
of the infection and to identify how many hosts are affected.
In addition, the Security Indices table shows how far beyond the limits this host has
exceeded the various indices per Stealthwatch appliance. The Traffic Summary table
shows you how much traffic this host is sending and/or receiving, which is helpful in
determining file sharing activity.
In the preceding example, we need to see how many other hosts this host has touched.
To do this, we go to the Has Touched Another column and double-click Yes. The
Touched Hosts document opens. We can see in the Touched Host column that the High
CI Host has touched a target host at least six times.
If you want to find out which user in your domain is associated with an IP address,
click the Identity, DHCP & Host Notes tab.
Note:
You must have a Stealthwatch IDentity appliance or Cisco ISE appliance to get
user identity data.
At this point, you have enough information to isolate both the source host and the
target hosts. You can now begin the cleanup process per your organization’s policies.
For instance, you can perform any of the following actions:
Run anti-virus software on each host.
If all the hosts are in the same host group, you can block or isolate the whole
host group.
Block the ports on which the data is being exchanged.
Note:
For information about adjusting parameters and editing policies, refer to Chapter
11, “Responding to Alarms.”
The Filter - Host Information dialog allows you to choose specific parameters to query
against for all hosts that fit within those parameters. For example, you can filter for all
hosts in a particular host group that are using a disallowed service or application, or
that are causing Worm Activity alarms.
Note:
Because you are performing an information query (IQ), this process is sometimes
called “performing a host IQ.”
Note:
If you filter for all hosts causing High Concern Index alarms as well as TCP_Scan
alerts, the result will contain a list of hosts that are most likely infected in some
way.
OVERVIEW
The following diagram illustrates the basic steps to follow when addressing a threat to
your network.
As you can see, you must answer the following three questions before you can do
anything about an alarm:
Which host originally caused the alarm?
Is the behavior that caused the alarm normal for this host?
What other hosts, if any, were affected?
Note:
You may also find that you are seeing a large number of unnecessary alarms for
activity that you know to be okay. For more information about reducing the
number of unnecessary alarms you see, refer to Chapter 12, “Reducing
Unnecessary Alarms.”
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 231
Once you have answered the preceding questions, you can then decide how to use the
SMC software to respond to the alarm. This chapter includes the most common
actions taken when responding to alarms.
Note:
Refer to the SMC Client Online Help to read about other procedures that you may
also want to perform when responding to alarms.
Responding to Alarms
232 © 2017 Cisco Systems, Inc. All Rights Reserved.
HOW TO RESPOND TO AN ALARM
There are several ways to respond to an alarm. You can acknowledge an alarm,
unacknowledge an alarm, close an alarm, and reopen a closed alarm. Refer to the
following sections to read about these particular procedures.
Acknowledging Alarms
When you acknowledge an alarm, you are indicating that it is being investigated. This
is beneficial to workflow and to make other team members aware that the alarm is
being investigated. Before you acknowledge an alarm, keep in mind that
acknowledging an alarm can be undone if necessary.
An alarm can be acknowledged or unacknowledged regardless of whether the alarm is
active or inactive. To use the SMC to acknowledge an alarm, complete the following
steps:
1. On the Alarm Table, right-click the alarm and select Workflow > Acknowledge
Selection.
You can also click the alarm, and then click the Acknowledge Selection button
on the Alarm Table toolbar.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 233
The Acknowledge Alarms dialog opens, requesting that you enter a note explaining
why the alarm is being closed.
Note:
Because the Acknowledge using the document Filter settings
option acknowledges alarms in bulk, it is much faster than the other
option, especially if you have 1000 or more alarms. However, you
must realize that by choosing this option, you may acknowledge
alarms that you have never seen.
3. Click in the text entry field, type an explanation as to why the alarm is being
acknowledged, and then click OK. A checkmark appears in the
Acknowledged column and the note appears in the Last Note column if you have
chosen to show these columns. The text in the table row for that alarm becomes
unbolded.
Responding to Alarms
234 © 2017 Cisco Systems, Inc. All Rights Reserved.
Note:
To see the Acknowledged and/or Last Note columns, right-click a column header
and select the appropriate option from the pop-up menu.
Unacknowledging Alarms
The SMC enables you to unacknowledge one or more acknowledged alarms. You may
want to complete the following steps, for example, if you have acknowledged any
alarms by mistake.
1. On the Alarm Table, display the acknowledged alarms that you want to unac-
knowledge. Use the alarm filter if necessary.
2. Right-click an alarm you want to unacknowledge and select Workflow >
Unacknowledge Selection. The Unacknowledge Alarms dialog opens.
3. Type an alarm note and click OK.
4. Repeat steps 2 and 3 for each alarm you want to acknowledge.
Closing Alarms
When you want to indicate that you are satisfied that an alarm has been resolved, you
can close the alarm. Note that it is not necessary to manually close alarms.
Once an alarm becomes inactive, it is automatically removed from the database when
it is older than the number of days specified for the Alarm Table on the SMC
Properties: Data Retention page. To access this page, right-click the SMC icon in the
Enterprise tree, and then click Configuration > Properties.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 235
Before you close an alarm, keep the following points in mind:
You cannot close an active alarm.
When you close an alarm for a particular host, that host may generate that
alarm again before the next archive hour.
Closing an alarm can be undone if necessary.
You can also click the alarm, and then click the Close Selection button on the
Alarm Table toolbar.
Responding to Alarms
236 © 2017 Cisco Systems, Inc. All Rights Reserved.
The Close Alarms window opens, requesting that you enter a note explaining why the
alarm is being closed.
3. Specify either to close the alarm or to close using the settings in the document
filter. Refer to the following explanations of the available options so you are
aware of the implications of closing alarms.
Close [x] Alarms – Acknowledges and closes only the alarms currently
displayed on the Alarm Table, where [x] equals the total number of alarms
displayed on the Alarm Table. If you click this option, the system will
acknowledge and close each alarm one by one. So, if you have a large
number of alarms, such as 1000 or more, the system will need a considerable
amount of time to finish the process with this option.
Close using the document Filter settings – Acknowledges and closes all of
the alarms included in the current filter settings in bulk rather than one by
one, including any new alarms that may occur during the closing process. For
example, suppose the Alarm Table Filter is set to display only Minor alarm
types, and you choose to close all of the alarms based on this setting. The
system will close not only the Minor alarms that you see on the Alarm Table
now, but also any Minor alarms that may be generated while the closing
process is underway, which you have not seen.
Note:
Because the “Close using the document Filter settings” option closes
alarms in bulk, it is much faster than the other option, especially if you
have 1000 or more alarms. However, you must realize that by
choosing this option, you may close alarms that you have never seen.
4. Click in the text entry field, type an explanation as to why the alarm is being
closed, and then click OK. A checkmark appears in the Closed column and
the note appears in the Last Note column if you have chosen to show these
columns.
Note:
To see the Acknowledged and/or Last Note columns, right-click a column header
and select the appropriate option from the pop-up menu.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 237
Reopening Closed Alarms
The SMC enables you to reopen one or more closed alarms. You may want to
complete the following steps, for example, if you have closed any alarm by mistake:
1. On the Alarm Table, display the closed alarms that you want to reopen. Use the
alarm filter if necessary.
2. Right-click an alarm you want to reopen and select Workflow > Reopen
Selection.
3. Type an alarm note, and then click OK.
4. Repeat steps 2 and 3 for each alarm you want to acknowledge.
Responding to Alarms
238 © 2017 Cisco Systems, Inc. All Rights Reserved.
STEALTHWATCH MITIGATION FEATURE
The Stealthwatch software provides a threat mitigation feature that you can use to
automate the system’s response to various threats. By using this feature, you can
reduce the time required to make decisions about how to respond to certain alarms.
The system will do it for you as soon as the alarm occurs.
The Stealthwatch mitigation feature can help you go from incident to resolution in
seconds. If you prefer, you can set the feature to perform mitigation immediately
(Automatic mode) or to ask you for authorization first (Authorize, or manual, mode).
The Stealthwatch mitigation feature is disabled by default. To enable it, you must
complete the following steps, which are detailed later in this section:
1. Configure the mitigation devices for each appliance where you want to use miti-
gation (e.g., define the firewall).
2. Enable the mitigation feature for the policies where you want to use mitigation.
3. Define the desired mitigation actions for individual alarms.
The following illustration provides a general overview of how the Stealthwatch
mitigation feature works:
When you enable this feature and a specified alarm then occurs, the Stealthwatch
system sends a signal to the mitigation device requesting the device to perform the
configured mitigation action. The device performs the requested action based on the
policy settings you have specified for that alarm.
Note:
The system will not perform mitigation against hosts that are on the Broadcast
List or on the Mitigation White List. For more information about these lists, please
refer to the SMC Client Online Help.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 239
Configuring the Mitigation Devices
You must configure the SMC to set up communication between the Stealthwatch
system and the mitigation devices. If you want several appliances to use the same
mitigation device, you must configure each appliance separately for that device.
Note:
You also may need to configure the mitigation devices themselves to receive
information from Stealthwatch devices. For more information, refer to the
Mitigation Device Configuration guide. You can find this document on the
Stealthwatch User Community Web site (https://community.lancope.com).
You can configure up to five of the following mitigation device types per appliance:
Brocade INM
Cisco ASA
Cisco Guard
Cisco Router (Internetworking Operating System 11.3 and later)
Custom
Radware DefensePro
Stealthwatch SNMP Mitigation Interface
Notes:
All of these mitigation device types (with the exception of Radware DefensePro)
are available only in the Stealthwatch module. Radware DefensePro is available
only in the DDoS module.
Choose the Custom option if you plan to use an expect script to customize
mitigation actions. However, we recommend that you contact Lancope Customer
Support for assistance before attempting to use expect scripts.
The type of mitigation device you choose determines the type of mitigation actions
that the system can perform. For example, a particular device may only support
blocking traffic coming from the source IP address.
Responding to Alarms
240 © 2017 Cisco Systems, Inc. All Rights Reserved.
To configure mitigation devices on the SMC, complete the following steps:
1. Right-click an appliance name and select Configuration > Mitigation Configu-
ration.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 241
3. Click the type of mitigation device you want to use, and then click OK. The
device information dialog opens for the device type you selected. For example,
if you click Cisco Router, the Cisco Router information dialog opens.
4. Ensure the Enable Device check box contains a check mark, as shown in the
preceding example. If you do not make this selection, the device will not receive
information from the Stealthwatch system, and the mitigation feature will not
work.
5. Complete all of the specific identifying information for the selected device, and
then click OK. The device information dialog closes and the device you added is
now included on the Mitigation Configuration dialog.
6. Repeat steps 2 through 5 until you have added all of the mitigation devices you
need to add for this appliance.
7. When finished, click Close to close the Mitigation Configuration dialog.
Responding to Alarms
242 © 2017 Cisco Systems, Inc. All Rights Reserved.
You are now ready to enable the mitigation feature per host group as described in the
next section.
Note:
The mitigation device must be running for the mitigation feature to work.
2. In the Role Policies section, click the desired Role Policy, and then click Edit.
The Edit Role Policy dialog opens.
3. In the Assign to: Host Groups: section, click Browse to select the host group(s)
to which the policy applies, and then click OK to return to the Edit Role Policy
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 243
dialog. (You can also specify specific host IP addresses or ranges in the IP
Address Ranges field.)
4. On the Edit Role Policy dialog, click the check box(s) to add a check mark(s) in
the Enabled column for each alarm for which you want to enable mitigation. (If
the desired alarms aren’t listed, click Add to add them.)
Responding to Alarms
244 © 2017 Cisco Systems, Inc. All Rights Reserved.
Defining Mitigation Actions for Alarms
You can now define the mitigation actions for the desired individual alarms. To do
this, complete the following steps:
1. Continuing from step 4 in the previous section, from the Edit Role Policy dialog
that is now open, select the row that contains the alarm for which you want to
enable mitigation, and then click Edit Mitigation. The Edit Mitigation dialog
opens (the contents may vary depending on the alarm).
Note:
Lancope provides recommended default settings for each mitigation
action. You can change these settings to suit your network needs
whenever desired.
2. Click the desired mitigation response on the pop-up menu based on the
following descriptions.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 245
Response Description
None To disable all mitigation actions for the alarm, click None.
3. Specify the other mitigation settings as indicated in the following table. You can
customize mitigation actions for each alarm based on a combination of source or
target IP address, protocol, and/or port number. You can even specify how long
the mitigation action is to run.
Mitigation
Purpose
Option
Source Blocks traffic coming from the host that originated the
suspicious activity.
Target Blocks traffic going to the host that is the target of the
suspicious activity.
Port Blocks the interface through which the suspicious traffic has
traveled.
Duration The length of time (in minutes) that you want the blocking action to be in
effect. When this time period expires, the mitigation process ends.
Note: A duration of 0 (zero) indicates infinity, meaning the
mitigation action will be in effect until the mitigation process is
manually ended.
Notes:
Cisco routers do not support the Port or Protocol mitigation actions.
OPSEC devices require that you enable both the Source and the
Target mitigation actions. Otherwise, these devices cannot block a
connection.
Responding to Alarms
246 © 2017 Cisco Systems, Inc. All Rights Reserved.
4. When you have specified the mitigation settings for the alarm, click OK. Your
settings are displayed on the Edit Role Policy dialog.
5. Repeat steps 1 through 4 for each alarm for which you want to configure the
mitigation settings.
6. When finished, click OK, and then click Close to close the Host Policy
Manager.
Note:
To display the Mitigation column, right-click in a column
header and select Mitigation.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 247
1. Right-click an alarm and select
Mitigation > Block.
The Start Mitigation dialog
opens.
2. If desired, change the mitigation action parameters, and then click OK. The Start
Mitigation dialog closes and the Alarm Table refreshes.
3. Find the alarm condition. The red “Not Blocking” icon
is now replaced with the green “Blocking” icon.
Note:
If you want to unblock the connection before the mitigation
action expires, simply right-click the alarm and select
Mitigation > Unblock.
Automatic Mode
When an alarm occurs with a mitigation action in Automatic
mode, the Alarm Table displays the green “Blocking” icon in
the Mitigation column, as shown in the previous example.
Note:
To display the Mitigation column, right-click in a column header and select
Mitigation.
Because the mitigation action is in Automatic mode, you do not need to do anything to
start it when the alarm occurs. However, if you need to stop the mitigation action,
complete the following steps:
Responding to Alarms
248 © 2017 Cisco Systems, Inc. All Rights Reserved.
1. In the Alarm Table, right-
click the alarm and select
Mitigation > Unblock. The
Alarm Table refreshes.
The Mitigation Actions document allows you to see the status of all mitigation actions
that have occurred in a domain since the last archive hour. To access the Mitigation
Actions document, right-click the domain in question, and then select Status > Miti-
gation Actions. The Mitigation document opens.
Responding to Alarms
© 2017 Cisco Systems, Inc. All Rights Reserved. 249
Responding to Alarms
250 © 2017 Cisco Systems, Inc. All Rights Reserved.
12
REDUCING UNNECESSARY
ALARMS
OVERVIEW
If certain policy settings are set too low, or services or applications that are identified
as okay are mistakenly disallowed for a particular host group, alarms can occur as the
result of behavior that is seen as suspicious, when in fact the behavior is normal. This
chapter describes how to reduce the number of unnecessary alarms you see.
This baseline represents the expected behavior for the day. Baseline is used in
conjunction with the tolerance to calculate the threshold values to use for that day.
Note:
For information about the concept of tolerance related to alarms, refer to “Alarms”
on page 286.
These 90 attributes become part of the host profile mentioned earlier. By default,
Stealthwatch baselines every host within the Inside Hosts host group. However, for
the Outside Hosts host group, Stealthwatch baselines only aggregate host behavior at
the host group level. You can change the baselining method at any time in the Host
Group Editor dialog.
To access this dialog, right-click
Host Group in the Enterprise
tree, and then select
Configuration > Edit Host
Groups.
A unique host level baseline will be established for each host in a host group only if
the Enable baselining for Hosts in this Group check box contains a checkmark;
otherwise, Stealthwatch will baseline aggregate host behavior at the host group level.
Note:
You can disable this feature for very dynamic environments, such as DHCP
scopes, where IPs change frequently. If you do, this will cause a baseline for
expected behavior of any DHCP host to behave like all DHCP hosts.
However, by default, Stealthwatch baselines only aggregate host behavior at the host
group level for the Outside Hosts group; therefore, by default this option is disabled
for Outside Hosts.
The following diagram illustrates the baselining process:
After the initial 7 days, Stealthwatch tracks 14 key attributes to create a rolling 28-day
baseline. This baseline is the average of the daily attribute values for the past 28 days,
heavily weighted for the last 7 days. Since the baseline incorporates the last seven
days, these are used to represent weekly values. Therefore, the baseline includes
values for the previous month, but is heavily weighted to the most recent week.
Note:
To see a list of the 14 alarms that are the source of these 14 key attributes, refer
to the table in “Variance-based Alarms vs. On/Off Alarms” on page 286.
A host policy takes precedence over all other policies. Therefore, a host policy is more
specific than a role policy, which is more specific than a default policy. Only the most
specific policy settings for a host will trigger an alarm.
Note:
A host cannot be assigned to more than one host policy.
This dialog allows you to configure policies using the following sections:
Host Policies – Allows you to manage a policy for a single host.
Role Policies – Allows you to manage policies for hosts according to the
roles they perform in your system.
Note:
For information about creating and editing role policies and host policies, refer to
“Creating and Editing Policies” on page 271.
CAUTION:
If you click Restore to Defaults, you will override the current policy with
the factory default policy settings, so use this feature with extreme
caution.
Tip:
If you are in the Alarm Table, a quicker way to find the controlling policy is to
enable the Policy column to be visible by right-clicking within a header and
selecting Policy from the pop-up menu. By looking at this column, you can
determine by which policy the alarm is controlled. From this point, if you want to
see the policy settings for a particular policy, double-click the policy name in the
Policy column.
As you can see in the previous example, the High File Sharing Index alarm is
controlled by the Servers role policy, and the High Traffic alarm is controlled by the
Inside Hosts policy.
The effective policy for a host will display in the Policy column the names of all
effective policies. When both a source policy and a target policy exists for a security
event, then the Policy column lists the source policy first and the target policy second.
Note:
For the next steps in responding to an alarm, refer to “Creating and Editing
Policies” on page 271.
Alarm Categories
Use this section to configure the alarm category with which this role policy is used.
Categories provide a way to group specific types of security events. Each of the alarm
categories can generate an alarm, depending on the number and type of events that
occur.
You can do the following:
Add or edit alarm category settings
Edit mitigation of alarms associated with the alarm categories
Enable or disable alarm categories
The types of alarm categories available are:
Item Description
Anomaly Tracks events that indicate that hosts are behaving
abnormally or generating traffic that is unusual, but is not
consistent with another category of activity.
Data Hoarding Indicates that a source or target host within a network has
downloaded an unusual amount of data from one or more
hosts.
High Concern Index Tracks hosts whose concern index has either exceeded
the CI threshold or rapidly increased.
High Concern Index and High Target Index categories use
the same events. If an event is triggered by a source host,
it results in a High CI category alarm. If an event is
triggered by a target host, it results in a High TI alarm.
High DDoS Source Indicates that a host has been identified as the source of a
Index DDoS attack.
High DDoS Target Indicates that a host has been identified as the target of a
Index DDoS attack.
High Target Index Tracks inside hosts that have been the recipient of more
than an acceptable number of scan or other malicious
attacks.
High Concern Index and High Target Index categories use
the same events. If an event is triggered by a source host,
it results in a High CI category alarm. If an event is
triggered by a target host, it results in a High TI alarm.
10. Change settings as necessary and click OK when finished. You are returned to
the Edit Policy dialog.
Note:
When settings are not configured for an alarm category, No Settings
appears in the Settings column.
When mitigation settings are not configured for an alarm category,
None appears in the Mitigation column.
11. To enable an alarm category, select the check box for the alarm category in the
Enabled column.
Tip:
Use the Enable All Categories or Disable All Categories button to
affect all alarm categories at once.
12. To issue an alarm for the security event, select the check box in the Alarm
column.
13. Do one of the following:
To apply the settings without exiting the Edit Policy dialog, click Apply >
Close.
Notes:
For information about the different types of settings for alarms, refer to “Alarms” on
page 286.
For recommended settings for specific alarms, refer to “Recommendations” on
page 292.
Security Events
Use this section to configure the security events used by a policy, edit settings or
mitigation of alarms associated with a CI, and enable or disable security events. Refer
to the following table for an explanation of the check boxes on the Security Events
tab.
Enable Source If you want a security event that is enabled for the
source to contribute points to any applicable alarm
categories.
Alarm Source If you want a security event that is enabled for the
source to also trigger its associated alarm.
Impact Source Target If you want a host policy or role policy to override the
source setting defined in the existing effective policy.
Note: This column is available only when you are
editing a host policy or role policy.
Enable Target If you want a security event that is enabled for the
target to contribute points to any applicable alarm
categories.
Alarm Target If you want a security event that is enabled for the
target to also trigger its associated alarm.
Refer to the following regarding situations in which specific types of security events
will not alarm:
One to Many (e.g., Max Flows Initiated) - This type of security event cannot
alarm at the target, so therefore you cannot select the Alarm Target check
box for this security event.
Many to One (e.g., SYNs Received) - This type of security event cannot
alarm at the source, so therefore you cannot select the Alarm source check
box for this security event.
7. Change settings as necessary and click OK when finished. You are returned to
the Edit Policy dialog.
8. To specify when and how mitigation should occur, select the security event you
want to edit.
9. Click Edit Mitigation.
The Edit Mitigation dialog opens.
10. Change settings as necessary and click OK when finished. You are returned to
the Edit Policy dialog.
Note:
When settings are not configured for an alarm category, No Settings
appears in the Settings column.
When mitigation settings are not configured for an alarm category,
None appears in the Mitigation column.
Tip:
Use the Enable All Events or Disable All Events button to affect all
events at once.
12. Depending on whether you want to issue an alarm for the source security event,
target security event, or both, click the applicable Alarm check boxes.
13. Do one of the following:
To apply the settings without exiting the Edit Policy dialog, click Apply >
Close.
To apply the settings and exit the Edit Policy dialog, click OK.
Notes:
For information about the different types of settings for alarms, refer to “Alarms” on
page 286.
For recommended settings for specific alarms, refer to “Recommendations” on
page 292.
CAUTION:
Remember that any edits you make to the Inside Host default policy or
the Outside Hosts default policy will affect global settings.
Create a role policy for this host. (Refer to “Creating Role Policies” on page
273.)
Create a host policy for this host. (Refer to “Creating Host Policies” on page
280.)
Tip:
To quickly move a single host to a group, right-click the host within any
document and select Configuration > Manage Host Groups. When
the Host Groups dialog for that host opens, select the desired group
from the top section of the dialog, and then click OK.
4. Complete any of the following steps to add IP addresses to the group you
specified in step 3.
In the Ranges field, type the IP address of the triggering host(s).
If you are adding more than one host and they exist within a range, then in the
Ranges field type the desired IP address ranges of the triggering hosts.
If you are adding more than one host and you have an existing file containing
the IP addresses of the triggering hosts, then click Import Ranges to import
the IP addresses.
5. Click OK. The Enterprise page tree menu automatically updates to include all
newly added IP addresses to the group you specified in step 3.
Note:
To prevent confusion, it is best if you do not use multiple role policies with the
same alarm unless there is a need to trigger alarms based on different values
(e.g., for different teams).
3. In the Name field, type a name for the policy you are adding (e.g., Accounting
Department).
4. In the Description field, type a description (optional).
5. Complete one of the following steps:
Type specific host IP addresses or ranges in the IP Address Ranges field.
In the “Assign to: Host Groups” field, click Browse. The Browse Host
Groups dialog opens.
6. Click the host group(s) to which the policy applies. If you click a parent host, all
hosts under it will automatically be selected.
8. Click Add at the bottom of the Add Role Policy dialog. The Security Events
dialog opens.
Note:
To select more than one alarm, hold the Ctrl key and click each alarm
you want to add. To select a range of alarms, click the alarm that is at
the top of the range you want to select, hold the Shift key, and then
click the alarm that is at the bottom of the range you want to select.
10. Select the check box for each alarm that you want this policy to trigger.
Tip:
If you find that you are about to assign a role policy to a range of IP addresses or
to multiple ranges of IP addresses, then instead create a host group for these IP
addresses, and then assign to this host group a role policy.
Note:
If you hover the cursor over an entry, a list of all enabled and disabled
alarms appears. In the previous example, no alarms have been
disabled; therefore, there are no disabled alarms listed.
The Edit Role Policy dialog opens. The Alarm Categories tab opens by default.
3. Double-click the alarm you want to edit (ensure you click within the Settings
column). The Edit Settings dialog for that alarm opens.
Notes:
For information about the different types of settings for alarms, refer to “Alarms” on
page 286.
For recommended settings for specific alarms, refer to “Recommendations” on
page 292.
2. Within the Host Policies section, enter the IP address of the host to which you
are adding a host policy.
3. Click Edit.
Note:
To select more than one alarm, hold the Ctrl key and click each alarm
you want to add. To select a range of alarms, click the alarm that is at
the top of the range you want to select, hold the Shift key, and then
click the alarm that is at the bottom of the range you want to select.
Note:
Ensure that the Enabled column contains a checkmark for every alarm
that you want this policy to trigger.
Notes:
For information about the different types of settings for alarms, refer to “Alarms” on
page 286.
For recommended settings for specific alarms, refer to “Recommendations” on
page 292.
Note:
The alarm categories are also variance-based.
Variance-based Alarms
Anomaly Port Scan
The main advantage of this approach is that you can adjust the system so that the
number of alarms that occur matches your organizational needs. That is, if you prefer
many alarms (i.e., you can tolerate only a slight change from the expected behavior),
you can lower the tolerance setting in the associated policy. Conversely, if you prefer
fewer alarms (i.e., you can tolerate significant change from the expected behavior),
you can raise the tolerance setting. Essentially, each of the settings for the variance-
based alarm is attached to a numerical value, and this value can be adjusted up or
down.
The thresholds used in variance-based alarms are generated from a baseline based on
recent activity and a configured tolerance. This gives a host the ability to change its
behavior over time without losing the capability to alarm if its behavior changes too
radically. Tolerance provides a way to control how much change is acceptable. In
essence, you have the ability to adjust the sensitivity of the alarm’s threshold level
(i.e., to “turn down the noise” to whatever level you want).
With variance-based alarms, a host must reach a certain level of deviation from its
baseline before an alarm will trigger. For instance, if the tolerance level for the High
Total Traffic alarm has been set to 50, then the system ignores the lowest 50% of the
values over the expected value (the host’s baseline), but will alarm on the ones above
that value.
Note:
For detailed information about alarm settings, refer to “Settings for Variance-
based Alarms” on page 289.
The second type of alarm is the alarm which you can either turn on or off. The criteria
for triggering this type of alarm differs from that of the variance-based alarm. In the
case of the alarm that simply has an on/off setting, the host’s behavior must match
certain conditions that must all coincide with each other before this type of alarm is
triggered. If all of these conditions do not exist, then the alarm will not trigger. For
instance, in order for a worm activity alarm to trigger, all of the following behavior
must have occurred:
A source host has scanned multiple sub-nets.
At least one of the target hosts has connected to the source host.
This target host has transferred information to the source host.
• Never trigger alarm when less than: Also known as the minimum
threshold, this is a static value that indicates the lowest value to allow
for triggering an alarm. The alarm will not trigger when the observed
value falls below this setting. In other words, even if a host is greatly
over its expected value, if it is not more than the minimum indicated in
this dialog, then do not trigger an alarm.
• Always trigger alarm when greater than: Also known as the maximum
threshold, this is a static value that indicates the highest value to allow
without triggering an alarm. The alarm will trigger when the observed
value exceeds this setting. In other words, if a host’s value exceeds the
maximum indicated in this dialog, even if it is expected for that host,
then trigger an alarm.
Threshold Only – When this option is selected, the dialog shows only the
maximum threshold setting.
Click Visual Editor to access the Visual Editor dialog. The Visual Tolerance Editor is
a graphical way to adjust the settings of a host or host group policy for a specific
alarm, as shown in the following example.
Notes:
To read detailed descriptions of these alarms and others, refer to the “Alarm List”
topic in the SMC Client Online Help.
For more information about how you can adjust the settings for the alarms listed
below, refer to “Settings for Variance-based Alarms” on page 289.
High Traffic
The High Traffic alarm indicates that the host traffic rate averaged over a five-minute
period has exceeded the limit of the acceptable traffic values. If you are uncomfortable
with the amount of high traffic alarms being seen, adjust the settings in the
corresponding policy/policies.
Raise the policy setting for the hosts or host groups in question above the average
number of bytes being reported.
Low Traffic
The Low Traffic alarm indicates that the host traffic rate averaged over a five-minute
period has fallen below the minimum acceptable traffic values. If you are
uncomfortable with the amount of low traffic alarms being seen, adjust the settings in
the corresponding policy/policies.
Raise the policy setting for the hosts or host groups in question above the average
number of bytes being reported.
Mail Relay
The Mail Relay alarm indicates that the target host may be operating as an Email
relay. If these are true mail servers, you can disable the Mail Relay alarm for the hosts/
Spam Source
The Spam Source alarm indicates that the source host may be sending Email spam. If
the host is a mail server, disable the Spam Source alarm for the hosts/host groups in
question by clicking the Enabled check box in the corresponding policy/policies to
remove the checkmark.
If the host is not a mail server, it may be infected.
Note:
The Suspect Long Flow alarm is always raised against the Inside Host,
regardless of the client/server relationship. If this alarm is disabled for an Outside
Host, any Inside Host connecting to that Outside Host is excluded from this alarm.
SYNs Received
The SYNs Received alarm indicates that a host has received too many unanswered
TCP connection requests (SYN packets) in a five-minute period. This alarm may
indicate a distributed (many-to-one) DoS attack.
However, it is common for servers to receive a large number of SYN packets. If this is
the case, raise the Never trigger alarm when less than setting above the average
number of alarms you are seeing. You may want to isolate servers that receive more
SYN packets than others into a separate host group, such as Web servers versus
application servers.
Worm Activity
The Worm Activity alarm indicates that a host has scanned and connected on a
particular port across more than one subnet. The details section of this alarm specifies
the port on which the activity was observed.
It is normal for domain controllers to perform address scanning on UDP ports and
ping scanning. If the Worm Activity alarms are occurring in host groups with domain
controllers, you can help prevent these alarms by removing the checkmarks from the
Addr_Scan/udp and Ping check boxes on the Security Events tab for the High
Concern Index alarm in the corresponding policy/policies.
OVERVIEW
This chapter describes processes such as how to save an SMC document with a
specific set of layout settings and filter settings, add a document to your list of login
documents, create a DAR file, share a document, generate a document on a regular
basis, and email a document to others.
This chapter includes the following topics:
Saving Documents
Sharing Documents
Scheduling Documents
Note:
If you want to make and retain changes to the document layout (such
as change the column positions or change which columns appear),
select File > Use Settings as Default. These changes will be in effect
the next time you open the document.
6. In the Name field, type a name for the document that you can easily recognize.
(The system suggests a name for you.)
7. (Optional) If you want other users to be able to open this document under their
user names, select the Public check box.
Note:
For more information about public documents, refer to “Public
Documents” on page 311.
8. (Optional) If you want the document to open automatically every time you log in
to the SMC client interface under your user name, select the “Add this document
to the Login Documents list” check box.
Note:
For more information about login documents, refer to “Login
Documents” on page 306.
9. Click OK. The document is saved to the SMC appliance. You can now open this
document under your user name, with the layout and/or filter settings you
specified, on any computer with SMC access.
Note:
By default, only documents saved under your user name appear. To list all
documents, including those created by other users, select the List All Public
check box.
Login Documents
You may add any document to your list of login documents. A login document
automatically opens each time you log in to the SMC client interface. This feature is
useful for viewing documents that you otherwise would open manually on a regular
basis.
To make a document a login document, complete the following steps:
1. From the SMC Main Menu, select File > Manage Documents. The Manage
Documents dialog opens.
4. Select the “List All Public” check box to see all public documents that have
been saved by other users.
Note:
To select more than one document, hold the Ctrl key and click each
document you want to add. To select a range of documents, click the
document that is at the top of the range you want to select, hold the
Shift key, and then click the document that is at the bottom of the
range you want to select.
6. Click OK. The Shared Documents dialog closes. The document(s) you selected
appears in the user’s list of login documents.
DAR Files
Exporting a document as a DAR file allows you to do things with a document such as
the following:
Copy it to your computer’s hard drive.
Copy it to a flash drive to use on another computer that has access to the
SMC appliance.
Share it with someone.
Note:
If you hover your cursor over the document tab, a tool tip appears, showing
details about the document, such as the original document name and who
created (“owns”) it.
2. Click the Shared Documents icon. The Shared Document page opens.
3. Select the desired document.
4. Click Edit Settings. The Edit Settings dialog opens.
If you want the system to wait to generate a The “Wait on DNS resolution” check box.
scheduled document until the IP addresses
referenced in the document have been Note: Enabling this feature may delay
resolved to names document generation. Each IP address may
take up to two seconds to resolve. If an IP
address is not resolved within two seconds,
the IP address is shown without the DNS
name.
To prevent the SMC from archiving or The “Suppress Empty File” check box.
emailing generated documents that have
no data
To specify the type of data you want to print CSV (comma-separated value) - Select
this option if you want to print only table
data contained in the generated
document(s).
• Each table is placed in a CSV file.
• All other types of data (e.g., maps,
graphs, charts) do not print.
• All CSV files for each document are
zipped in a file (i.e., one zipped file per
document).
• All zipped files are emailed to each
user who is designated to receive
email copies of the document(s)
generated by the selected schedule.
- continued -
Notes:
If you do not enable a table on the Pages page in the Print Settings
dialog, then the schedule will not create a CSV file for that table even
if the schedule is configured to create CSV files.
7. Click the Period drop-down list and select how often you want the SMC to
generate any document that is associated with this schedule. You may choose to
generate scheduled documents on an hourly, daily, weekly, or monthly basis.
Depending on which option you choose, different fields appear for you to
specify more detail.
For example, if you select Daily, two fields
appear for you to specify the time of day you
want the schedule to run and if you want the
schedule to run every day, every other day,
every third day, etc.
8. Continue to “Adding a Document to a
Schedule” on page 315.
Note:
In the above example, the Stealthwatch Daily Reports (Midnight)
schedule has been selected. Note that there is no checkmark in the
Enabled column, signifying that this schedule has not been enabled
for your account. If the schedule is not enabled, none of the
documents in the schedule will be generated.
2. Select the List All Public check box if it is not already selected. (For more
information, refer to “Public Documents” on page 311.)
3. Select the document(s) you want to add to the schedule. For this example, we
will select the Domain Dashboard document.
Note:
To select more than one document, hold the Ctrl key and click each
document you want to add. To select a range of documents, click the
document that is at the top of the range you want to select, hold the
Shift key, and then click the document that is at the bottom of the
range you want to select.
4. Click Add. The document(s) appears in the Include in this Schedule field.
5. Do you want the SMC to automatically email the scheduled document(s) to you?
If yes, continue to “Adding a User’s Email Address to a Schedule” on page
318.
If no, click OK to save the information, exit the Add (or Edit) Schedule
dialog, and return to the Manage Documents dialog.
3. (Optional) In the From Email Address field, type an address using the following
format:
If you are the owner of the document, the new filter settings take effect in
the original document. From this point on, any time this document is
generated or opened by anyone who has the privileges to access this
document, the new filter settings will be in effect.
You can edit the filter settings of a shared document so that when it is generated per a
schedule, it will use those filter settings automatically. To do this, complete the
following steps:
Note:
For more information about filtering documents, refer to "Filtering Document
Data" in Chapter 3, “Navigating the SMC Client Interface.”
2. Click the Shared Documents icon. The Shared Documents page opens.
3. Select the desired document.
4. Click Edit Filter. The Filter dialog opens.
7. Click the Print icon (circled in the previous image). The Print dialog opens.
You can either print a hard copy of the document or download it to your local
hard drive.
OVERVIEW
Note:
Only users with Administrator privileges can perform the procedures in this
chapter.
The SMC provides a great deal of flexibility in setting up users with different levels of
privileges. For example, you can allow one user to view and modify every area of the
network. Alternatively, you can restrict certain users so that they can view only
specific areas of the network without the ability to do anything else.
This chapter includes the following topics:
Process Overview
Adding the Authentication Service(s)
Controlling What Users Can View and Configure (Data Roles)
Controlling What Users Can Do (Function Roles)
Adding a User Account
Associating Scheduled Documents With a User’s Account
Login Documents
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 323
PROCESS OVERVIEW
In general, the process for managing users in the SMC involves completing the
following procedures as detailed in this chapter:
1. If you want the SMC to automatically email scheduled documents to users, then
add the email server information to the SMC as described in “Adding the Email
Server to the SMC” on page 317 in Chapter 13, “Working with Documents.”
2. Add the authentication service(s) your network uses.
3. Decide which data each user should be able to view and configure.
4. Add a data role for the user.
5. Decide which SMC functions (i.e., menu options) each user should be able to
access.
6. Add a function role for the user.
7. Add the user with the applicable data and function roles.
Note:
Users with Administrator privileges can access all SMC functions, as
well as view and configure all data.
Note:
Changes do not become effective until users log in. Therefore, if you modify any
of these elements while affected users are logged in, they will not see these
changes until they log out and then log in again.
Managing Users
324 © 2017 Cisco Systems, Inc. All Rights Reserved.
ADDING THE AUTHENTICATION SERVICE(S)
Notes:
If you choose to use local authentication, you do not need to perform this
procedure.
If your network does not use a RADIUS or TACACS server, you must authenticate
locally.
The first step in managing users is to decide whether to authenticate locally (internal)
or use an authentication service (external). By default, the Stealthwatch System uses
local authentication.
Authentication is the process by which the identity of a client or user is verified by a
server or host. The process can take many forms, but usually it involves the client
presenting a password to the server for verification in order to obtain access.
If you have one of the following authentication services, then you can configure the
SMC to leverage one of these services for system access capability. Stealthwatch
supports the following authentication services:
RADIUS (Remote Authentication Dial-in User Service)
TACACS+ (Terminal Access Controller Access Control System
Important:
If your system is using Windows Internet Authentication Service as the RADIUS
authentication server, the user’s Active Directory user account must have “Dial-
in” access enabled. Otherwise, the user will not be able to log in to the SMC
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 325
2. Click the Authentication Service icon. The Authentication Service page opens.
4. Select the desired service, and then click OK. The Add Authentication Service
dialog opens.
Managing Users
326 © 2017 Cisco Systems, Inc. All Rights Reserved.
Number of seconds that a user/password is valid before the cache times out
and the system requires the authentication server.
Note:
Each SMC document and each cell in an SMC document requires
validation for the user and assigned roles. The SMC caches the
authentication for the cache timeout number of seconds so that users
do not have to log in for each SMC document.
6. Click Add to add the authentication server information. The Add [Service
Name] Server dialog opens.
7. In the appropriate fields, type the following information for the authentication
server:
IP address
Port number associated with the authentication service
• RADIUS default = 1645
• TACACS+ default = 49
The secret (RADIUS) or the key (TACACS+) given to the user by the
domain administrator
8. Click OK. The Add Server dialog closes. The Servers table on the Add
Authentication Service dialog updates with the new server.
9. Click OK. The Add Authentication Service dialog closes. The new service
appears on the Authentication Service page.
10. Click Close to close the User & Role Management dialog, or continue to the
next section.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 327
CONTROLLING WHAT USERS CAN VIEW AND
CONFIGURE (DATA ROLES)
The SMC allows you to define data roles for users. Data roles control which
information a user can view (read) and configure (write), including the following:
Domains
Host groups
VM Servers
VMs
Flow Collectors
Exporters
FlowSensors
External Devices
Identity Devices
Data roles also provide an effective way of hiding data that you do not want users to
see. For example, if your system uses redundant (failover) Flow Collectors, duplicate
data is reported to the SMC: data from the primary Flow Collector and the same data
from the failover. However, you can create a data role that hides the data from the
failover Flow Collectors. Then, users who are assigned this data role will see only the
data from the primary Flow Collectors.
Note:
For more details on the preceding scenario, refer to “Adding a Data Role to Hide
Redundant Flow Collector Data” on page 330.
Note:
You must assign a data role to each user that you add.
You can create new data roles as needed. You can modify or delete any data role that
you create. However, you cannot modify or delete the default data roles.
Managing Users
328 © 2017 Cisco Systems, Inc. All Rights Reserved.
To add a data role, complete the following steps:
1. From the SMC Main Menu, select Configuration > User Management. The
User & Role Management dialog opens.
2. Click the Data Roles icon. The Data Roles page opens.
3. Click Add.
The Add Data Role dialog opens.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 329
6. Select the check boxes for the items you want a user with this data role to be able
to view, configure, or both.
Note:
To hide data from a user simply do not select the View check box for
the item associated with that data (e.g., redundant Flow Collectors).
7. Click OK. The Add Data Role dialog closes. The new data role appears on the
Data Roles page.
8. Click Close to close the User & Role Management dialog, or continue to the
next section.
Important:
If the primary Flow Collector fails, and the user’s data role hides the redundant
Flow Collector, the user will not see any data. To remedy this, edit the user’s
account to assign a data role that shows the redundant Flow Collector.
Managing Users
330 © 2017 Cisco Systems, Inc. All Rights Reserved.
Adding a Data Role for the Primary Flow Collector(s)
To add a data role for the primary Flow Collector(s), complete the following steps:
1. From the SMC Main Menu, select Configuration > User Management. The
User & Role Management dialog opens.
2. Click the Data Roles icon. The Data Roles page opens.
3. Click Add. The Add Data Role dialog opens.
4. In the Name field, type a name for the data role, such as Flow
Collector_Primary.
5. (Optional) In the Description field, type a description of the data role.
6. Scroll down to the primary Flow Collector(s) and select the check boxes for the
items you want a user with this data role to be able to view, configure, or both.
7. Click OK. The Add Data Role dialog closes. The new data role appears on the
Data Roles page.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 331
Adding a Data Role for the Redundant Flow Collector(s)
To add a data role for the redundant Flow Collector(s), complete the following steps:
1. On the Data Roles page of the User & Role Management dialog, click Add. The
Add Data Role dialog opens.
2. In the Name field, type a name for the data role, such as Flow Collector
_Secondary.
3. (Optional) In the Description field, type a description of the data role.
4. Scroll down to the redundant Flow Collector and select the check boxes for the
items you want a user with this data role to be able to view, configure, or both.
5. Click OK. The Add Data Role dialog closes. The new data role appears on the
Data Roles page.
You now have data roles for both primary and redundant Flow Collectors and
can assign them to users as described in “Adding a User Account” on page 335.
6. Click Close to close the User & Role Management dialog, or continue to the
next section.
Managing Users
332 © 2017 Cisco Systems, Inc. All Rights Reserved.
CONTROLLING WHAT USERS CAN DO
(FUNCTION ROLES)
After you create the desired data role, the next step in defining a user is to create a
function role. Function roles control which SMC menu items users can access and the
activities they can perform. The SMC ships with the following default function roles:
All – Allows users to view all menu items and change anything within the
SMC client interface.
Configuration Manager – Allows users to view all menu items and configure
all appliances and domain settings.
Network Engineer – Allows users to view all traffic-related menu items
within the SMC client interface, append alarm and host notes, and perform
all alarm actions, except mitigation.
Security Analyst – Allows users to view all security-related menu items,
append alarm and host notes, and perform all alarm actions, including
mitigation.
Stealthwatch Power User – Allows users to view all menu items,
acknowledge alarms, and append alarm and host notes, but without the
ability to change anything.
You can create additional function roles as needed. You can also modify or delete any
function role, including the defaults.
To add a function role, complete the following steps:
1. From the SMC Main Menu, select Configuration > User
Management. The User & Role Management dialog opens.
2. Click the Function Role icon. The Function Roles page opens.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 333
3. Click Add. The Add Functional Role
dialog opens.
4. In the Name field, type a name for the
function role.
5. (Optional) In the Description field, type
a description of the function role.
6. Select the check boxes for the items you
want users with this function role to be
able to view or perform.
7. Click OK. The Add Functional Role
dialog closes. The new function role
appears on the Function Roles page.
8. Click Close to close the User & Role Management dialog, or continue to the
next section.
Managing Users
334 © 2017 Cisco Systems, Inc. All Rights Reserved.
ADDING A USER ACCOUNT
After you add the desired data role and function role, you can add a user and assign the
appropriate roles. The SMC ships with an admin user already defined. You can modify
any user, including the default admin user. You can delete any user, except the admin
user.
Note:
You must add a user account for anyone you want the SMC to automatically
email scheduled documents.
You
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 335
3. Click Add. The Add User dialog
opens.
4. In the Name field, type the
user’s login name (case-
sensitive).
5. (Optional) In the Description
field, type a description for the
user.
6. Select the authentication service
that will be used to authenticate
the identity of the user.
7. If you want the SMC to send
email reports and alarms to this
user, enter the user’s email
address.
8. Select the Enabled check box to
allow this user to log in to the SMC client interface, as well as receive scheduled
documents via email.
9. Does the user require Administrator privileges?
If yes, select the SMC Manager check box. Then, go to step 12.
If no, continue to the next step.
10. In the Data Role section, click the drop-down box and select the data role you
want to assign to this user (e.g., Flow Collector_Primary.
11. In the Function Roles section, select the function role(s) you want to assign to
this user.
12. Click OK. The Add User dialog closes and
the Password dialog opens.
13. In the Current section, type the admin user’s
password.
14. If applicable, do the following:
In the New section, type a password for
the new user (case-sensitive).
In the Confirm Password field,
re-type the password.
Managing Users
336 © 2017 Cisco Systems, Inc. All Rights Reserved.
15. Click OK. The Password dialog closes. The new user appears on the Users page.
16. Do you want to associate any scheduled documents with this user’s account?
If yes, continue to “Associating Scheduled Documents With a User’s
Account” on page 340.
If no, go to step 17.
17. Do you want to add any login documents to this user’s account?
If yes, go to “Login Documents” on page 349.
If no, click Close to exit the User & Role Management dialog.
Important:
If the primary Flow Collector Fails, and the user’s data role hides the redundant
Flow Collector, the user will not see any data.
Note:
Changes do not become effective until users log in. Therefore, if you modify any
of these elements while affected users are logged in, they will not see these
changes until they log out and then log in again.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 337
3. Select the user account you want to edit.
4. Click Edit. The Edit User dialog for that user opens.
5. To change the data role, in the Data Role section, click the drop-down box and
select the data role, such as one that shows redundant Flow Collectors.
6. Change any other settings for this account as appropriate.
7. Click OK. The Edit User dialog closes. The user’s new information appears on
the Users page. These changes will take effect the next time the user logs in.
8. Do you want to associate any scheduled documents with this user’s account?
If yes, continue to “Associating Scheduled Documents With a User’s
Account” on page 340.
Managing Users
338 © 2017 Cisco Systems, Inc. All Rights Reserved.
If no, go to step 9.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 339
ASSOCIATING SCHEDULED DOCUMENTS
WITH A USER ’S ACCOUNT
There may be situations in which you want to generate a document automatically
using the same settings (e.g., filters, layout, time interval) every time. To do this, you
need to add the document to a schedule that contains the settings you want.
Stealthwatch provides two ways of associating scheduled documents with a user
account. If you are the admin user, you can use the User & Role Management dialog
as described in this section to do this as you create/edit a user’s account.
Individual users can use the Manage Documents dialog to accomplish this for their
own accounts as described in Chapter 13, “Working with Documents.”
Note:
This section assumes that the desired document(s) have already been saved on
the SMC appliance. For more information on saving documents, refer to Chapter
13, “Working with Documents.”
A document schedule merely sets the parameters for how often one or more
document(s) run and how long they will be archived. The SMC comes with a set of
default schedules, which are associated with all user accounts automatically. Not all
default schedules are enabled. But, they are all available for each user.
In addition, users can create custom schedules for themselves. Finally, you — as an
admin user — can associate custom schedules to a user’s account as described in this
section when you create the account.
The process for associating a schedule with a user’s account involves completing the
following procedures:
1. Add a new, or edit an existing schedule.
2. Add one or more document(s) to the schedule.
3. (Optional) If you want the SMC to automatically email scheduled documents to
the user when they are created, add the user’s email address to the schedule.
Managing Users
340 © 2017 Cisco Systems, Inc. All Rights Reserved.
Adding a New Schedule
To add a new schedule to a user’s account, complete the following steps:
1. From the SMC Main Menu, select Configuration > User
Management. The User & Role Management dialog opens.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 341
7. Click the Schedule icon. The Schedule page opens.
8. In the Name field, type a name for the schedule. For this example, we will name
the schedule, “Analyst Reports.”
9. Define the parameters in the General section as shown in the
following table:
If you want the system to wait to generate a Select the “Wait on DNS resolution” check
scheduled document until the IP addresses box.
referenced in the document have been
resolved to names Note: Enabling this feature may delay
document generation. Each IP address may
take up to two seconds to resolve. If an IP
address is not resolved within two seconds,
the IP address is shown without the DNS
name.
To prevent the SMC from archiving or Select the “Suppress Empty PDF” check box.
emailing generated documents that have
no data
- continued -
Managing Users
342 © 2017 Cisco Systems, Inc. All Rights Reserved.
If you want... Then...
To specify the type of data you want to print CSV (comma-separated value) - Select
this option if you want to print only table
data contained in the generated
document(s).
• Each table is placed in a CSV file.
• All other types of data (e.g., maps,
graphs, charts) do not print.
• All CSV files for each document are
zipped in a file (i.e., one zipped file per
document).
• All zipped files are emailed to each
user who is designated to receive
email copies of the document(s)
generated by the selected schedule.
PDF - Select this option if you want to
print all data contained in the generated
document(s).
• Each generated document is placed in
a PDF file.
• Each PDF file is zipped in a file.
• All zipped files are emailed to each
user who is designated to receive
email copies of document(s)
generated by the selected schedule.
CSV & PDF - Select this option if you
want to print table data in CSV format
and all other data in PDF format.
• Each table is placed in a CSV file.
• All other types of data in each
generated document are placed in a
PDF file (i.e., one PDF file per
document).
• All files belonging to a document are
zipped in a file (i.e., one zipped file per
document).
• All zipped files are emailed to each
user who is designated to receive
email copies of document(s)
generated by the selected schedule.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 343
Notes:
If you do not enable a table on the Pages page in the Print Settings
dialog, then the schedule will not create a CSV file for that table even
if the schedule is configured to create CSV files.
10. Click the Period drop-down list and select how often you want the SMC to
generate any document that is associated with this schedule. You may choose to
generate scheduled documents on an hourly, daily, weekly, or monthly basis.
Depending on which option you choose, different fields appear for you to
specify more detail.
For example, if you select Daily, two fields
appear for you to specify the time of day you
want the schedule to run and if you want the
schedule to run every day, every other day,
every third day, etc.
11. Continue to “Adding a Document to a
Schedule” on page 346.
Managing Users
344 © 2017 Cisco Systems, Inc. All Rights Reserved.
Editing an Existing Schedule
If the schedule you want to associate with a user account already exists, complete the
following steps to edit the schedule accordingly:
1. From the Main Menu, select Configuration > User Management. The User &
Role Management dialog opens.
Note:
In the above example, the Stealthwatch Daily Reports (Midnight) schedule has
been selected. Note that there is no checkmark in the Enabled column, signifying
that this schedule has not been enabled for the user’s account. If the schedule is
not enabled, none of the documents in the schedule will be generated.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 345
7. Click Edit. The Edit Schedule dialog opens.
2. Select the List All Public check box if it is not already selected. (For more
information, refer to “Public Documents” on page 311 in Chapter 13, “Working
with Documents.”
Managing Users
346 © 2017 Cisco Systems, Inc. All Rights Reserved.
3. Select the document(s) you want to add to the schedule. For this example, we
will select the Domain Dashboard document.
Note:
To select more than one document, hold the Ctrl key and click each
document you want to add. To select a range of documents, click the
document that is at the top of the range you want to select, hold the
Shift key, and then click the document that is at the bottom of the
range you want to select.
4. Click Add. The document(s) appear in the Include in this Schedule field.
5. Do you want the SMC to automatically email the scheduled document(s) to this
user?
If yes, continue to "Adding a User’s Email Address to a Schedule" next in
this chapter.
If no, click OK to save the information, exit the Add (or Edit) Schedule
dialog, and return to the Manage Documents dialog.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 347
Adding a User’s Email Address to a Schedule
Note:
If you have not done so previously, you must add the email server’s IP address to
the SMC before the SMC can email any schedule documents. (For more
information, refer to “Adding the Email Server to the SMC” on page 317 in
Chapter 13, “Working with Documents.”
If you want the SMC to automatically email scheduled documents to someone, you
must add their email address to the schedule by completing the following steps:
1. On the Add (or Edit) Schedule dialog, click the Email icon. The Email page
opens.
Note:
To select more than one email address, hold the Ctrl key and click
each email address you want to add. To select a range of email
addresses, click the email address that is at the top of the range you
want to select, hold the Shift key, and then click the email address
that is at the bottom of the range you want to select.
4. Click OK to save the information, close the Add (or Edit) Schedule dialog, and
return to the Manage Documents dialog.
5. Do you want to add any login documents to this section?
If yes, continue to "Login Documents" next in this chapter.
If no, close the remaining dialogs.
Managing Users
348 © 2017 Cisco Systems, Inc. All Rights Reserved.
LOGIN DOCUMENTS
You may add any document to your list of login documents. A login document
automatically opens each time you log in to the SMC client interface. This feature is
useful for viewing documents that you otherwise would open manually on a regular
basis.
Note:
This section assumes that the desired shared document(s) has already been
created. For more information on creating shared documents, refer to Chapter 13,
“Working with Documents.”
To make a document a login document for a user’s account, complete the following
steps:
1. From the SMC Main Menu, select Configuration > User Management. The
User & Role Management dialog opens.
5. Click the Login Documents icon. The Login Documents page opens.
Managing Users
© 2017 Cisco Systems, Inc. All Rights Reserved. 349
6. Click Add. The Shared Documents dialog opens showing all the documents that
you have saved.
7. Select the List All Public check box to see all public documents that have been
saved by other users.
8. Select the document(s) you want to add to the user’s list of login documents. For
this example, we will select the Domain Dashboard document.
Note:
To select more than one document, hold the Ctrl key and click each
document you want to add. To select a range of documents, click the
document that is at the top of the range you want to select, hold the
Shift key, and then click the document that is at the bottom of the
range you want to select.
9. Click OK. The Shared Documents dialog closes. The document(s) you selected
appears in the user’s list of login documents.
Managing Users
350 © 2017 Cisco Systems, Inc. All Rights Reserved.
INDEX
U
UDP Flood alarm ..................................... 302