Cisco Secure Network Analytics

Cisco Secure Network Analytics, formerly Stealthwatch, is an enterprise network detection and response (NDR) platform designed to provide continuous visibility and advanced threat detection across complex hybrid enterprise networks, data centers, and multi-cloud environments. Operating without requiring intrusive endpoint agents, the platform ingests and correlates rich network telemetry, including NetFlow, IPFIX, sFlow, and cloud provider flow logs, establishing dynamic behavioral baselines for every connected device and network entity across the enterprise.

The platform deploys through physical hardware appliances, virtual machine instances, or SaaS-delivered cloud analytics engines, supporting distributed enterprise architectures. Using machine learning algorithms and heuristic behavioral modeling, Cisco Secure Network Analytics identifies abnormal network behaviors, insider threats, credential misuse, lateral movement, data exfiltration, and command-and-control beaconing in real time. It features the Encrypted Traffic Analytics engine, which identifies malware hidden within encrypted TLS/SSL sessions without requiring decryption. The platform integrates bi-directionally with Cisco Identity Services Engine, Cisco Secure Firewall, Cisco Secure Workload, and Cisco XDR for rapid threat mitigation.

Core enterprise use cases include internal network threat hunting, insider threat detection, unauthorized asset discovery, automated policy verification, and zero trust segmentation auditing. By converting existing network infrastructure into a ubiquitous security sensor grid, Cisco Secure Network Analytics allows security teams to detect stealthy attacks that bypass perimeter defenses.