Secure Network Analytics Understanding External Connections Guide

Introduction

Use this guide to review external connections that are required for certain Secure Network Analytics features to operate expeditiously.  These external connections can be domains or endpoints.  Domains are names used for identifying resources on the internet, usually websites or services; and endpoints are actual devices or nodes that communicate across a network. Since the focus for this guide is web services, these will be shown as URLs.  The table lists the external connection URLs in alphabetical order.

Tip: The table lists the external connection URLs in alphabetical order.

External Connections

Additional Information

To further assess how and why specific domain and endpoint connections are used, refer to the following topics:

• Cisco Secured Service Exchange (SSE)
• Direct Software Downloads (Beta)
• MITRE ATT&CK® Framework
• Threat Feed

Cisco Secured Service Exchange (SSE)

SSE endpoints are used for data transit to Amazon Web Services (AWS), by Cisco for customer service metrics, and also used when forwarding alerts to Cisco XDR. These vary
based on Region and Hosts. These endpoints are discovered dynamically using a Service Discovery mechanism provided by the SSE Connector. When publishing detections to Cisco XDR, Secure Network Analytics attempts to discover a service titled "xdr-data-platform" and its API endpoint "Events."

Region and Hosts

Depending on the region in production environments, the hosts are as follows.

US:

• https://api-sse.cisco.com
• https://sensor.ext.obsrvbl.com

EU:

• https://api.eu.sse.itd.cisco.com
• https://sensor.eu-prod.obsrvbl.com

APJC:

• https://api.apj.sse.itd.cisco.com
• https://sensor.anz-prod.obsrvbl.com

Direct Software Downloads (Beta)

The following connections are used by the Direct Software Downloads feature:

• https://apix.cisco.com
• https://software.cisco.com
• https://id.cisco.com

To use this new feature to download software and patch update files directly to your Update Manager, make sure you've registered using your cisco.com user ID (CCOID).
1. Log in to the Manager.
2. From the main menu, choose Configure > Global > Central Management.
3. Click the Update Manager tab.
4. Click the Direct Software Downloads link to open the registration page.
5. Click the Register button to begin the registration process.

6. Click the link that is provided.
7. You will be taken to the Activate Your Device page. Click Next to continue.
8. Log in with your cisco.com user ID (CCOID).
9. You will receive a "Device Activated" message once your activation is complete.
10. Go back to the Direct Software Downloads page on your Manager and click Continue.
11. Click the links for the EULA and K9 agreements to read and accept the terms. Once the terms are accepted, click Continue.

For more information about Direct Software Downloads, contact Cisco Support

MITRE ATT&CK® Framework

The MITRE ATT&CK® Framework is a publicly available knowledge base of adversary tactics and techniques based on real-world observations. When you've enabled Analytics within Secure Network Analytics, MITRE tactics and techniques assist with cybersecurity threat intelligence, detection, and response.

The following connections allow Secure Network Analytics to access MITRE information
for alerts:

• https://raw.githubusercontent.com/mitre/cti/master/ics-attack/ics-attack.json
• https://raw.githubusercontent.com/mitre/cti/master/mobile-attack/mobileattack.json
• https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterpriseattack.json

Threat Feed

The Cisco Secure Network Analytics Threat Feed (formerly Stealthwatch Threat Intelligence Feed) provides data from the global Threat Feed about threats to your network. The feed updates frequently and includes IP addresses, port numbers, protocols, host names, and URLs known to be used for malicious activity. The following host groups are included in the feed: command-and-control servers, bogons, and Tors.

To enable Threat Feed in Central Management, follow the instructions in the Help.

1. Log in to your primary Manager.
2. Select Configure > Global > Central Management.
3. Click the (Help) icon. Select Help.
4. Select Appliance Configuration > Threat Feed.

For more information about Threat Feed, refer to the System Configuration Guide.

Contacting Support

If you need technical support, please do one of the following:

• Contact your local Cisco Partner
• Contact Cisco Support
• To open a case by web: http://www.cisco.com/c/en/us/support/index.html
• For phone support: 1-800-553-2447 (U.S.)
• For worldwide support numbers:
  https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html