You can't defend what you can't see. Corporate networks keep getting harder to see: more branches, remote users, cloud workloads and IoT devices, and attackers who move around inside the network instead of knocking on the front door. Cisco Secure Network Analytics (SNA), still called Stealthwatch in many conversations, is built around exactly that problem. It uses telemetry the network already produces to show who is talking to whom, and flags behaviour that does not look right.
Stealthwatch to SNA: what actually changed
The rename came with real changes. The old Java-based interfaces were replaced by one modern web dashboard. Analysis of encrypted traffic improved, and machine learning now plays a bigger part in detection. Integration with other security tools and automated response got deeper, monitoring of cloud and hybrid environments is smoother, and licensing moved to a smart, subscription-style model. The core idea is the same as before, just faster and smarter.
How SNA works
SNA collects flow telemetry (NetFlow, IPFIX, sFlow, J-Flow) from routers, switches and firewalls and runs behavioural analysis on it to catch anomalies that may point to an attack. Because it sees internal east-west traffic as well as north-south traffic, it can surface insider threats, lateral movement, zero-day malware behaviour, APT activity and DDoS before they do real damage. The main building blocks are:
- Flow Rate License: defines how many flows per second the system may collect and analyse.
- Flow Collector: receives NetFlow, IPFIX and other flow data from routers, switches, firewalls, proxies, endpoints and other infrastructure, and aggregates it.
- Management Console: one console that brings together up to 25 Flow Collectors plus sources such as Cisco Identity Services Engine, with graphical views, identity context and custom reports.
- Flow Sensor: adds deep packet inspection and behavioural analysis to identify applications and protocols where native flow export is not available.
- UDP Director: a high-performance device that receives telemetry from several locations and forwards it as a single stream to one or more destinations.
Optional licences extend it further: Cloud (visibility into cloud and hybrid deployments), Endpoint (device-level context through AnyConnect NVM), Learning Network (an Integrated Services Router acting as a branch sensor) and Threat Intelligence (global threat feeds that raise alarms on suspicious communication).
Encrypted traffic without decrypting it
Encryption protects data, but attackers also use it to hide malware from network security tools, and decrypting everything is rarely practical. SNA applies machine learning and statistical modelling to flow metadata to spot malicious patterns inside encrypted traffic without decrypting it, and it adapts as network behaviour changes over time.
Where it fits next to SIEM and packet capture
- A SIEM depends on syslog from devices, and a compromised device cannot be trusted to report honestly. Signature-based tools only see what they already know about.
- Full packet capture is expensive and complex, so in practice it covers only small parts of the network.
- Flow-based behavioural monitoring fills the gap between the two and scales to large networks, because one-way flow records are de-duplicated and stitched together. It can also be paired with a packet analyser to capture the packets of a flow that triggered an alarm.
What I use it for
- Spotting internal and external threats across every conversation on the network.
- Faster incident response and forensics, because network activity can be kept for months or years as an audit trail.
- Supporting compliance, segmentation, performance monitoring and capacity planning from the same data.
How I deploy SNA
In my experience the software itself is not hard to install. The real work is deciding where telemetry comes from, then letting the system learn what normal looks like before tuning alarms. Cisco invented NetFlow, and SNA is where that heritage meets behavioural analytics.
Flow rate sizing
I size the flow rate licence with some headroom, because it caps how many flows per second the system can collect and analyse.
NetFlow and telemetry sources
I turn on flow export on the right routers, switches and firewalls, and add Flow Sensors where native export is not possible.