Stealthwatch Security Analytics Service on Cisco DNA Center

About Stealthwatch Security Analytics Service on Cisco DNA Center

The Stealthwatch Security Analytics service on Cisco DNA Center, in conjunction with Cisco Stealthwatch, provides real-time monitoring of all network traffic. When you use the Stealthwatch Security Analytics service to enable your Network as a Sensor with Encrypted Traffic Analytics, you can enhance the protection of your network against encrypted threats without decrypting the traffic.

The Stealthwatch Security Analytics service on Cisco DNA Center automates the provisioning of network elements (based on best practices) so that they send data to Cisco Stealthwatch, enabling you to gain additional visibility, and improving your malware detection capabilities.

The capabilities of Stealthwatch Security Analytics include the following:

  • Assessing what parts of the network are ready for deployment

  • Enabling Stealthwatch Security Analytics

  • Monitoring the status of deployment

  • Disabling Stealthwatch Security Analytics

Install Stealthwatch Security Analytics

Procedure

Step 1

On the Cisco DNA Center home page, click the Software Updates icon.

Step 2

Click Go to Software Updates.

Step 3

Ensure that the Updates is selected in the tab on the left.

Step 4

Click Install next to Stealthwatch Security Analytics, listed under Automation.

After the installation is complete, the Stealthwatch Security Analytics service shows up under the Installed Apps tab.

Register Stealthwatch

Procedure

Step 1

From the Cisco DNA Center home page, click the gear icon () and select System Settings.

Step 2

Click Settings from the bar at the top.

Step 3

From the left navigation pane, select Stealthwatch.

Step 4

In the IP Address field, enter the IP address of your Stealthwatch Management Console.

Step 5

Enter the Username and Password for the Stealthwatch Management Console. It is recommended that you create a DNACadmin account with administrator privileges on the Stealthwatch system with a secure password.

Step 6

Click Apply.

After Stealthwatch has successfully been registered, the status will display as Active | Registered and Running, just above the IP Address field.

Enable Stealthwatch Security Analytics

Procedure

Step 1

From the Cisco DNA Center home, navigate to the Provision page.

Step 2

Select the Services tab.

Step 3

Click Stealthwatch Security Analytics.

Step 4

In the left pane, drill down to the site or fabric for which you want to enable Stealthwatch Security Analytics. Alternatively, you can search for the site or fabric using the search bar.

Step 5

Select the site or fabric for which you want to enable Stealthwatch Security Analytics by clicking the site card.

The site card displays the number of devices that are enabled, ready, and not ready.

Note 

At least one device must be ready for you to enable Stealthwatch Security Analytics.
Step 6

Review the readiness check and click Get Started.

Step 7

From the drop-down list, select the IP address of the Stealthwatch Flow Collector that you wish to use for this site or fabric.

If you do not see the desired Stealthwatch Flow Collector in the drop-down list, then it probably has not been defined in the Stealthwatch Management Console. For more information, see the Stealthwatch Management Console VE and Flow Collector VE Installation and Configuration Guide.

Step 8

Click Schedule Deployment.

Step 9

Ensure that the Ready tab is selected in the device table.

Step 10

Review the list of devices that will be enabled.
Step 11

Select the corresponding radio button to deploy the application immediately (Now), or at a later time (Later).

Note 

For deployments scheduled for a later time, you can edit the scheduled time from the Notifications list in the upper-right corner of the screen, by clicking Edit.

Step 12

Click Enable.

Step 13

You can view the status of your deployment from the Scheduled Tasks tab under the Notifications list ().

After your task is complete, the status of the deployment changes from In Progress to Success.

Note 

To ensure that you're viewing the updated status, click the Refresh button in the upper-right corner of the Notifications list.

Note 

As per Cisco validated design, only Access Ports are configured in Switches, and only Internet Ports are configured in Routers. All other ports are excluded.

Disable Stealthwatch Security Analytics

Procedure

Step 1

From the Cisco DNA Center home, navigate to the Provision page.

Step 2

Select the Services tab.

Step 3

Click Stealthwatch Security Analytics.

Step 4

In the left pane, drill down to the site or fabric for which you want to disable Stealthwatch Security Analytics. Alternatively, you can search for the site or fabric using the search bar.

Step 5

Select the site or fabric for which you want to disable Stealthwatch Security Analytics by clicking the site card.

The site card displays the number of devices that are enabled, ready, and not ready.

Note 

At least one device must be enabled for you to disable Stealthwatch Security Analytics.
Step 6

Ensure that the Enabled tab is selected in the device table.

Step 7

Select the corresponding radio button to disable Stealthwatch Sercurity Analytics immediately (Now), or at a later time (Later).

Note 

If you have chosen to disable Stealthwatch Security Analytics at a later time, then you can edit the scheduled time from the Notifications list () in the upper-right corner of the screen, by clicking Edit.

Step 8

Click Disable.

Step 9

You can view the status of your deployment from the Scheduled Tasks tab under the Notifications list.

After your task is complete, the status of the deployment changes from In Progress to Success.

Note 

To ensure that you're viewing the updated status, click the Refresh button in the upper-right corner of the Notifications list.

Troubleshoot Stealthwatch Security Analytics Service

The Stealthwatch Security Analytics service displays error messages within the UI to ensure that your usage of the application is as problem-free as possible. Apart from the error messages, you can use either or both of the following to troubleshoot any issues you might be facing.

View Audit Logs

Audit logs capture information about the various applications running on Cisco DNA Center.

Procedure

Step 1

From the Cisco DNA Center home page, click the gear icon () and choose Audit Logs.

The Audit Logs window appears, where you can view logs about what has happened across the system.

The following information is displayed for eaech audit log:

  • Description: Audit log description

  • Site: Name of the site for the specific audit log

  • Device: Devices for the audit log

  • Requestor: User requesting the action that is being logged

  • Source: Source of an audit log

  • Created On: Date on which the audit log was created

Step 2

Click the plus icon (+) next to an audit log to view the corresponding child audit logs.

Each audit log can be a parent to several child audit logs. By clicking this plus icon, you can view a series of additional child audit logs.

Note 

An audit log captures data about a task performed by Cisco DNA Center. Child audit logs are subtasks to a task performed by Cisco DNA Center.

Step 3

Filter the audit logs by clicking the Filter icon, entering a specific parameter, and then clicking Apply.

You can filter audit logs by using the following parameters:

  • Description

  • Site

  • Device

  • Requestor

  • Source

  • Start Date

  • End Date
Step 4

(Optional) Click the dual arrow icon to refresh the data displayed in the window.
Step 5

(Optional) Click the download icon to download a local copy of the audit log in .csv file format.

A .csv file containing audit log data is downloaded locally to your system. You can use the .csv file for additional review of the audit log or archive it as a record of activity on Cisco DNA Center.

Troubleshoot Using Task Manager

Procedure

Step 1

On the Cisco DNA Center home page, click the Notifications icon () in the upper-right portion of the application screen.

Step 2

Ensure that the Scheduled Tasks tab is selected.

Step 3

Identify the Failed task in the list, and click the corresponding arrow.

The entry expands to show you the details of the task.

Note 

A single task may include multiple devices. The overall status of a task will show as Failed if even one device fails, although the other devices included in the task are successful.

Troubleshoot on Supported Devices

Following are some common troubleshooting issues experienced on supported devices.

Device is not listed

If Cisco DNA Center does not list a device to enable or disable Stealthwatch Security Analytics, then complete the following steps:

Procedure
Step 1

If you are using ASR and ISR Series Routers, then ensure that their Device Role is set to Border Router.

Step 2

If you are using 9300 and 9400 Series Switches, then ensure that their Device Role is set to Access.