Administering & Managing Cisco Stealthwatch Operation

Administering & Managing Cisco Stealthwatch Operation Certification Training Course Overview

Enroll for the 6-day Administering & Managing Cisco Stealthwatch Operation training course from Koenig Solutions accredited by Cisco. This course is designed how to focuses on using Cisco Stealthwatch Enterprise from the perspective of a security analyst.

Through a blend of hands-on labs and interactive lectures, you will be able to learn to use the Stealthwatch System to investigate potential security issues and make initial determinations on whether to proceed with a more thorough investigation or move on to the next potential threat.

Target Audience:

This course focuses on new users of Cisco Stealthwatch. This course is intended for customers whose role is to use the Cisco Stealthwatch System to monitor network performance.

Learning Objectives

After completing this course, you will be able to:

  • Describe how the Stealthwatch System provides network visibility through monitoring and detection.
  • Describe the goals of using Stealthwatch in the proactive and operational modes.
  • Define basic concepts of investigation and detection of potential security issues using the Stealthwatch System.
  • Complete workflows to identify indicators of compromise in your network.
  • Describe alarm types and alarm notification within Stealthwatch.
  • Explain the utility of maps in the Stealthwatch System.
  • Describe how the Stealthwatch System contributes to successful incident handling


Administering & Managing Cisco Stealthwatch Operation (Duration : 40 Hours) Download Course Contents

Live Online Training
Group Training 2000 Date On Request
1-on-1 Training (GTR) 2300
4 Hours
8 Hours
Week Days

Start Time : At any time

12 AM
12 PM

GTR=Guaranteed to Run
Classroom Training (Available: London, Dubai, India, Sydney, Vancouver)
Duration : On Request
Fee : On Request
On Request
Buy Flexi For Only $99 (Online Training Re-imagined)

Course Modules

Module 1:- Cisco Stealthwatch for System Administrators (SSA)
  • Why Stealthwatch? What is Stealthwatch
  • Introduction to Stealthwatch
  • Basic Stealthwatch System Installation : Part 1
  • Basic Stealthwatch System Installation: Part 2
  • SMC Configuration
  • The Many User Interfaces of Stealthwatch
  • Stealthwatch Application Validation
  • Management Console: Basic Setup
  • Hosts and Host Groups
  • Classify Services and Applications/ Classification of Customer Environment
  • Network Devices and the By Function Host Group
  • Policy Management: Group Policy
  • User and Role Management
  • Custom Documents
  • Response Management
  • Review the Web Application: What’s New?
Module 2:- Cisco Stealthwatch for Network
  • Workflows for Proactive Monitoring
  • Validate Exporters
  • Proactive with Hosts and Host Groups
  • Proactive by Using Maps
  • Proactive with Host Locking
  • Proactive with Custom Security Events
  • Proactive with Policy Management
  • Proactive with Response Management
  • Proactive with Custom Documents
  • Reactive Workflows
  • Reacting to Overloading Interfaces
  • Reactive to Network Issues Where the Host IP is Known
  • Reacting to Slow Response
  • Reacting to New Devices and Unknown Devices Added to the Network
  • Reacting to Reoccurring Issues on the Network
  • Documenting Investigations After Resolution
Module 3:- Cisco Stealthwatch for Security
  • Introduction to Security
  • Using Stealthwatch in the Proactive Mode
  • Pattern Recognition
  • Investigation and Detection Using Stealthwatch
  • Using Top Reports and Flow Tables for Detection
  • Creating and Using Dashboards for Detection
  • Creating Custom Security Events
  • Proactive Investigation Practice
  • Using Stealthwatch in the Operational Mode
  • Alarms and Alarm Response
  • Responding to Alarms
  • Maps
  • Using Maps for Incident Response
  • Host Identification
  • Identify Hosts Using Host Snapshot and Host Report
  • Culminating Scenario: Using Stealthwatch for Insider Threats
  • Security Best Practices in Stealthwatch
  • Cisco Stealthwatch Security Course Outcomes
Module 4 : LAB
  • Appliance Setup Tool
  • Appliance Post-Install Configuration & Verification
  • Additional SMC and Central Management Configuration
  • Configure Host Groups
  • Cisco Router NetFlow Configuration and Validation
  • Cisco Router ETA Configuration and Validation
  • Custom Security Events
  • Accessing the Stealthwatch Desktop Client
  • Verify Flow Data and Exporters
  • Classification of Customer Environment
  • Classification of Undefined Services and Application
  • Cisco ISE Integration (Identity Services Engine)
  • Configure the AD LDAP Lookup Feature
  • Creating a Custom Document
  • Response Management
  • Configure Appliance SNMP Agent
  • Determine Estimated FC Database Storage Capacity
  • Create Configuration Backups
  • Stealthwatch Patching - Central Management
  • Health Check - Inventory
  • Health Check - Data Gathering
  • Health Check - UDP Director Log Review
  • Health Check - Flow Collector Log Review
  • Health Check - SMC Log Review
  • Health Check - Flow Sensor Log Review
  • Remediation - Secondary SMC
  • Remediation - Additional FC
  • Remediation - SMC
  • Stealthwatch Apps
  • Remediation - NetFlow Template
  • Advanced NetFlow Configuration
  • NBAR
  • Remediation - Enable ASA NetFlow
  • SIEM Integration
  • NVZ Flow - AnyConnect
  • Tuning - Basic
  • Tuning - Advanced
  • Custom Security Events - ETA
  • Incident Response & Threat Hunting
  • Stealthwatch API
  • Relationship Policy
  • External Lookups
  • Cisco ISE ANC Integration
  • Multiple FC
Download Course Contents

Request More Information

Course Prerequisites

It is recommended that the learner have the following skills before attending this course:

  • Cisco Certified Network Associate Routing and Switching (CCNA ) certification
  • Cisco Certified Network Professional Security (CCNP Security) certification
  • Operating system administration familiarity (for example, Linux and Windows)