StealthWatch

[Alexandr_P]

Hello, all!

Can you tell me, please, what analog of Cisco's StealthWatch we have?

Thank you!

[Alexandr_P]

Thank you all for information!

For now it's only comparison at the stage of rendering a similar solution.
Only for understanding can we do the similar or not and how we can do this.

[Tripathy__Priya]

Hope you got the response which you were looking for. If needed any more info then let us know on this.

[Tripathy__Priya]

Cisco Stealthwatch uses Net flow to provide visibility across the network, data center, branch offices, and cloud. Its advanced security analytics uncover stealthy attacks on the extended network. Stealthwatch helps us use our existing network as a security sensor and enforce to dramatically improve the threat defense. As per extreme standard this can be replaced as s flow in stead of net flow to serve this better.

Please find below the article link to configure s flow on extreme devices:

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-sFlow/

[Zdeněk_Pala]

The integration between Extreme Control (identity and access management / network access management) is done through alarming = if anything changes with the endsystem the syslog message is generated (java application does have bell icon). Extreme SIEM (Qradar) does recognize the format.

The integration between Extreme Analytics (purview) in old versions was done through syslog. in the new version it is through ipfix = from Analytics Engine to SIEM.

Z.