Security Monitoring with Flow-Based Analytics
Security Monitoring in CBRTHD centers on Cisco Secure Network Analytics (formerly Stealthwatch) and the flow telemetry feeding it. You are tested on architecture, on reading behavioral alarms, and on turning an alarm into a contained incident.
Architecture you should be able to sketch
- Secure Network Analytics Manager (SMC): single pane for alarms, flow search, reporting, host groups and detection policy.
- Flow Collector: receives and stores NetFlow, IPFIX and sFlow from routers, switches and firewalls for long-term query.
- Flow Sensor: converts mirrored (SPAN) traffic into unsampled flow records and adds application identification; it also performs the Encrypted Traffic Analytics analysis work.
- UDP Director: duplicates and fans out flow exports to multiple collectors instead of burdening the exporter.
- Secure Cloud Analytics: agentless coverage for public cloud workloads and agent-based telemetry where flows are unavailable.
The detection engine baselines normal per-host behavior, so host groups and inside/outside network definitions are the single most important configuration. If internal subnets are misdeclared, traffic is treated as external and behavioral alarms become meaningless.
Reading an alarm
Detections fall into recognizable families: reconnaissance (horizontal scans sweep many hosts on one port, vertical scans sweep many ports on one host), command and control, exfiltration and data hoarding (asymmetric outbound volume), availability/volumetric DDoS, policy violations, and anomaly alerts. Correlate with threat intelligence feeds and Umbrella for newly seen domains.
Worked example
An HR workstation alarms: 5 MB outbound to a rare external IP, in sessions roughly every 60 seconds, sustained overnight. Reasoning: regularity plus low volume equals beaconing, which is a command-and-control pattern rather than a user action. Confirm with flow search on the client IP to get target, port and duration; check the destination's reputation and ASN; then pivot to Secure Endpoint to identify the process holding the connection and its parent. Contain by isolating the endpoint, capture memory, and block the destination. Before escalating, rule out a sanctioned backup or SaaS client by checking application identification and the logged-in user.
Traps that cost marks
- Trusting alarm severity over host-group criticality; a domain controller alarm outranks a lab VM.
- Expecting NetFlow to reveal filenames or URLs; flow has headers, not payload.
- Forgetting baseline learning time after adding a new subnet, which floods the console with false anomalies.
- Responding to a scan alarm without checking whether it preceded a successful connection.