The Learning Agent employs Cisco NetFlow and Deep Packet Inspection (DPI), and Network Based Application Recognition (NBAR); abilities which are at present in all Cisco branch routers, to gather, associate, and scrutinize security data to implement cutting-edge irregularity and zero-day attack identification. There is a well-defined Flexible NetFlow record in the router installation which forwards that information to the agent running in the router’s memory.
A crucial Learning Network feature is the solution’s capabilities to adapt; to find new irregularities and functioning with an operator to do fix them on the spot by recognizing the irregular features and generating and applying extenuations for circumstances as they arise. This level of automation is actually required due to how intricate and capacious traffic torrents and movements are becoming.
Old-style irregularity and incursion discovery and deterrence are resilient at catching threats which are already known and recognizable. They are not able to find new risks as they are heavily reliant on what they have been programmed to know and not what they learn as events are unfolding in real time.
One more benefit of the Learning Network as compared with old-style protection solutions is its level of accuracy. Traditionally, irregularity discovery systems have been rated based on the amount of possible security happenings they are able to find. Given that many of these incidents turn out to be non-risks based or unrelated, old-style systems need regular fine tuning or else they will produce large numbers of needless warnings and commotion.
The Cisco Stealthwatch Learning Network concentrates on keeping its findings accurate and only warning you and taking action on events which pose real threats confirmed by an operator, with simple Like/Dislike feedback features, enabling the Learning Network to find only pertinent irregularities.
It’s crucial to keep in mind that the learning manager functions independently from the Cisco Prime Network Management App. Therefore, it allows you to separate your protection processes from networking processes, which can be extremely beneficial, contingent on how your business is set up.
The Cisco Learning Network encompasses the abilities of Cisco’s market leading Stealthwatch Network Anomaly Detection (NBAD) and Visibility solution and both can be installed in the same Cisco ISR device.
The Cisco Learning Network can incorporate information from the Cisco Identity Services Engine (ISE) or access to Cisco Talos Threat intelligence feeds to give an operator even more data and more granular visibility.
The Cisco Stealthwatch Learning Network license transforms your ISR routers into security devices. The Learning network is not required to continually keep updating signatures or rules/lists. It learns what’s standard and what isn’t by acclimatizing itself with day to day traffic patterns. This provides you a much more dynamic, always up-to-date methodology to branch-office protection.
To learn more, please speak to our licensing specialists today.
