--- title: Cisco Secure Network Analytics (Stealthwatch) Explained description: "Cisco Secure Network Analytics, formerly Stealthwatch, explained: components, use cases and how flow analytics finds threats inside your network." image: https://blog.iptel.com.au/hubfs/Blogs/Cisco%20Secure%20Network%20Analytics/Cisco%20Secure%20Network%20Analytics%20(Instagram%20Post).gif --- [![IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)](https://blog.iptel.com.au/hs-fs/hubfs/IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png?width=200&height=59&name=IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png "IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)")](https://iptel.com.au) - [Home](https://iptel.com.au/) - [Solutions](https://iptel.com.au/solutions) Technologies - [Cisco Access Manager](https://iptel.com.au/technologies/cisco-access-manager) - [Cisco Catalyst Center](https://iptel.com.au/technologies/cisco-catalyst-center) - [Cisco Meraki](https://iptel.com.au/technologies/cisco-meraki) - [Cisco SDA Fabric](https://iptel.com.au/technologies/cisco-sda-fabric) - [Cisco Spaces](https://iptel.com.au/technologies/cisco-spaces) - [Everpure Storage](https://iptel.com.au/technologies/everpure-storage) - [Industrial IoT](https://iptel.com.au/technologies/industrial-iot) - [LAN](https://iptel.com.au/technologies/lan) - [Security and Cisco ISE](https://iptel.com.au/technologies/security-and-cisco-ise) - [ThousandEyes](https://iptel.com.au/technologies/thousandeyes) - [Virtualisation](https://iptel.com.au/technologies/virtualisation) - [Wi-Fi](https://iptel.com.au/technologies/wi-fi) Services - [Backup Assure](https://iptel.com.au/services/backup-assure) - [Cisco Network Upgrades](https://iptel.com.au/services/cisco-network-upgrades) - [Cisco URWB](https://iptel.com.au/services/cisco-urb) - [Cisco Webex Calling](https://iptel.com.au/services/cisco-webex-calling) - [Eco-Friendly Network Refresh](https://iptel.com.au/services/eco-friendly-network-refresh) - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Splunk](https://iptel.com.au/services/splunk) - [Wi-Fi Assurance Review](https://iptel.com.au/services/wi-fi-assurance-review) - [Wi-Fi Surveys](https://iptel.com.au/services/wi-fi-surveys) - [Industries](https://iptel.com.au/industries) Education and Healthcare - [Education and Campuses](https://iptel.com.au/industries/education) - [Healthcare and Clinical](https://iptel.com.au/industries/healthcare) - [Hospital Wi-Fi Onboarding](https://iptel.com.au/services/hospital-wi-fi-onboarding-cisco-ise) - [Aged Care](https://iptel.com.au/industries/aged-care) Enterprise - [Enterprise Networks](https://iptel.com.au/industries/enterprise) Industrial - [Mining and Camps](https://iptel.com.au/industries/mines) - [Utilities](https://iptel.com.au/industries/utilities) Retail & Warehousing - [Retail](https://iptel.com.au/industries/retail-and-stores) - [Warehousing](https://iptel.com.au/industries/warehousing) Entertainment - [Stadiums](https://iptel.com.au/industries/stadiums) - [Hospitality](https://iptel.com.au/hospitality-and-hotels) - [MSP](https://iptel.com.au/managed-services) Meraki - [Meraki Access](https://iptel.com.au/managed-services/meraki-access-and-security) - [Meraki Security and SD-WAN](https://iptel.com.au/managed-services/meraki-sd-wan) Cisco - [Cisco Campus Access](https://iptel.com.au/managed-services/cisco-campus-access) - [Cisco SD-WAN](https://iptel.com.au/managed-services/cisco-sd-wan) - [Cisco ISE](https://iptel.com.au/managed-services/cisco-ise) Security and Collaboration - [Security Service Edge](https://iptel.com.au/managed-services/security-service-edge) - [Meeting Rooms](https://iptel.com.au/managed-services/meeting-rooms-as-a-service) Data Centre and More - [AI Infrastructure](https://iptel.com.au/managed-services/ai-infrastructure) - [Non-Cisco Devices](https://iptel.com.au/managed-services/non-cisco-device-management) Free Assessment - [Managed Services Assessment](https://score.iptel.com.au/managed-network-services) - [Equipment](https://iptel.com.au/services/network-equipment-supply) Equipment Supply - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Buy Cisco Equipment](https://iptel.com.au/services/cisco-equipment-supply) - [Buy Meraki Equipment](https://iptel.com.au/services/meraki-equipment-supply) Get Pricing - [Get a Hardware Quote](https://iptel.com.au/services/network-equipment-supply#hardware-quote) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) - [Blog](https://blog.iptel.com.au) - [Resources](https://iptel.com.au/resources) Free Resources - [Top Wi-Fi Secrets](https://iptel.com.au/top-8-wi-fi-secrets) - [Cisco SDA Fabric](https://iptel.com.au/the-cios-guide-to-sda-fabric) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) Assessments - [ASD Essentials Assessment](https://score.iptel.com.au/asd-essentials-network-assessment) - [Cloud AI Assessment](https://score.iptel.com.au/cloud-ai-assessment) - [Collaboration Assessment](https://score.iptel.com.au/collaboration-assessment) - [Managed Services Assessment](https://score.iptel.com.au/managed-network-services) - [Network Assessment](https://score.iptel.com.au/network-assessment) - [Security Assessment](https://score.iptel.com.au/security-assessment) - [Splunk Assessment](https://score.iptel.com.au/splunk-assessment) Tools - [Automating Meraki](https://www.automatingmeraki.com) - [MAC Address Converter](https://iptel.com.au/resources/mac-address-converter) - [ThousandEyes Option Tool](https://score.iptel.com.au/thousandeyes) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) Demos and Design - [Request a Meraki Demo](https://iptel.com.au/free-meraki-demo) - [FREE Meeting Room Design](https://iptel.com.au/schedule-meeting-room-design-session) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) - [About](https://iptel.com.au/about-us) IPTel Solutions - [About us](https://iptel.com.au/about-us) - [Job Applications](https://careers.iptel.com.au/job-application) - [Privacy Policy](https://iptel.com.au/privacy-policy) - [Careers Blog](https://careers.iptel.com.au) Contact Us - [Contact Us Form](https://iptel.com.au/contact-us) - [Email Us](mailto:sales@iptel.com.au) Customer - [Customer Feedback](https://iptel.com.au/customer-feedback) - [Customer Referral](https://iptel.com.au/customer-referral) - [Terms and Conditions](https://iptel.com.au/terms-and-conditions) News Stories - [Project Guardian uses Networking Infrastructure as a Sensor](https://www.dailytelegraph.com.au/news/nsw/transport-for-nsw-launches-worldfirst-sensor-trial-to-stop-rail-and-bridge-trespassers/news-story/8dc52e8fbca4c471da408e670cf0163e) - [IPTel partners for monitoring for Meeting Rooms as a Service](https://www.commsbusiness.co.uk/content/news/highlight-partners-with-iptel-solutions) - [Webex Monitoring with Highlight](https://itbrief.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [ITBrief with Meeting Room Monitoring](https://itbrief.com.au/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [Cisco Webex Meeting Rooms Monitoring](https://telconews.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [IPTel adopts Highlight](https://itbrief.com.au/story/iptel-adopts-highlight-to-enhance-managed-services) - [Highlight MSP Upgrade](https://datacentre.solutions/news/71753/iptel-solutions-upgrade-with-highlights-service-platform) - [Cisco 360](https://www.crn.com.au/news/2026/networking/aussie-partners-react-cisco-360) - [DP World Transformation](https://www.cisco.com/site/us/en/about/case-studies-customer-stories/dp-world.html) - [Cisco Managed Services](https://www.arnnet.com.au/article/1251771/how-partners-can-take-a-leap-of-faith-with-managed-services.html) - [Project Delivery Excellence](https://channellife.com.au/story/cisco-honours-top-nz-partners-cisco-live) - [Great Place to Work](https://greatplacetowork.com.au/companies/iptel-solutions/) - [Wi-Fi Doesn't have to be Unreliable](https://www.techpartner.news/feature/iptel-wi-fi-doesnt-have-to-be-unreliable-494069) Buying from IPTel - [Buying Panels](https://iptel.com.au/professional-supply-panels) - [IPTel Store](https://store.iptel.com.au) - [Request a Quote](https://iptel.com.au/request-a-quote) - [Managed Services](https://iptel.com.au/managed-services-enquiry) Case Studies - [DP World Video](https://blog.iptel.com.au/hubfs/Case%20Studies/DP%20World_Case_Study.mp4) - [DP World](https://blog.iptel.com.au/dp-world-case-study) - [Backup Assure](https://blog.iptel.com.au/backup-assure-a-disaster-recovery-case-study) [Contact Us](https://iptel.com.au/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. ## Cisco Secure Network Analytics Oct 10, 2025 Do you ever wonder what is happening on your network? Sometimes it seems slow, clients don’t seem to act the way you think they should and you have a suspicion you might have been hacked. ![Cisco Secure Network Analytics](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Cisco%20Secure%20Network%20Analytics/Cisco%20Secure%20Network%20Analytics-still.jpg?width=1792&height=960&name=Cisco%20Secure%20Network%20Analytics-still.jpg) Cisco SNA (Secure Network Analytics - formerly Stealthwatch) is all about helping you spot unusual activity on your network that may not trigger alarms with other monitoring tools. The SNA solution is able to analyse thousands of network sessions and determine when something looks suspicious and can provide context-based alerting that actually makes sense and allows for fast prioritisation of alerts. SNA closely monitors the activity of all connected devices and uses multiple analytical techniques to determine anomalous behaviours that deviate from “normal”, but also has a deep understanding of known bad behaviours; allowing us to identify threats that you wouldn’t have known to look for! Cisco SNA provides detailed analytics on normal network behaviours, providing alerting and analytics on departure from the expected baseline. The baseline produced by SNA allows you to quickly and easily determine when a departure from that baseline is a threat to your network. Related reading - [Cisco AI Analytics in operation](https://blog.iptel.com.au/cisco-ai-analytics-in-operation) - [Cisco Machine Learning and AI](https://blog.iptel.com.au/cisco-machine-learning-and-ai) --- ## Cisco SNA Components Thanks to the current generation of Catalyst network devices, the network itself is generating lots of meta [![Securing your Cisco Wireless Network (Instagram Post)](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Securing%20your%20Cisco%20Wireless%20Network/Securing%20your%20Cisco%20Wireless%20Network%20(Instagram%20Post).png?width=200&height=200&name=Securing%20your%20Cisco%20Wireless%20Network%20(Instagram%20Post).png)](https://blog.iptel.com.au/securing-your-cisco-wireless-network)data; Cisco SNA then takes all that metadata, de-duplicating it, stitching it with other metadata, and preparing it for a lot of the analytics. The system is built and designed using a number of discrete components, including an SNA Manager, datastore and inbound flow devices. The components you need are largely dictated by the size of the install you need to undertake.   The key SNA components are: - **SNA Manager:** Aggregate and display all flows - **SNA Datastore:** For larger SNA installations, virtual or appliance based datastore - **Flow Sensor:** Optional component to produce flow telemetry for network segments that cannot produce NetFlow natively - **Cisco Telemetry Broker:** Ingest a variety of telemetry sources, for forwarding on to Cisco SNA Additionally, integration with Cisco XDR (Extended Detection and Response) is able to provide a broader view of your organisation, helping you to perform extended threat hunting and forensic investigations by aggregating and correlating telemetry from other parts of the network as well as from SNA, allowing you to draw the bigger picture of an attack in a simplified, enriched, and correlated manner. SNA and XDR work very well together by complementing each other; detections and telemetry from SNA are one source of data feeding into XDR, and along with other data from multiple technologies to identify incidents without having to focus purely on network-based detections and visibility. Optionally, another valuable component of SNA is an integration with Cisco’s Global Threat Intelligence, Talos. Providing an additional layer of protection against sophisticated attacks. Correlating suspicious activity with data on thousands of known command and control services to provide accurate and thorough detection and faster threat response. Talos stops in the order of 200 million threats per day! Related reading - [Cisco Meraki Dashboard](https://blog.iptel.com.au/cisco-meraki-dashboard) - [Cisco Meraki Wireless Overview](https://blog.iptel.com.au/cisco-meraki-wireless-overview) - [Meraki Cloud Wi-Fi](https://blog.iptel.com.au/meraki-cloud-wifi) --- ## Cisco SNA Use Cases There are various workflows and use cases possible, as detailed below. ### Real-Time Threat Detection [![Meraki and Cisco Better Together (Instagram Post)](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Cisco%20and%20Meraki%20Better%20Together/Meraki%20and%20Cisco%20Better%20Together%20(Instagram%20Post).png?width=200&height=200&name=Meraki%20and%20Cisco%20Better%20Together%20(Instagram%20Post).png)](https://blog.iptel.com.au/meraki-and-cisco-better-together)Detection of various types of threats and suspicious behaviours, including encrypted malware and policy violations. Data modelling is used to analyse in real time the activity of every device on the network. Baselines are created of normal behaviour; additionally, hundreds of security observations are applied (heuristics) that look at various types of traffic behaviour.   ### Remote Worker Monitoring Receive telemetry from the Cisco Secure Client (formerly AnyConnect) Network Visibility Module, to collate detailed end-point specific data. ### Encrypted Traffic Analytics ETA allows you to analyse encrypted traffic without needing to decrypt it using enhanced telemetry from [![D6 Cisco Secure Access (Instagram)](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Managed%20Services%20-%20D6%20Cisco%20Secure%20Access/D6%20Cisco%20Secure%20Access%20(Instagram).png?width=200&height=200&name=D6%20Cisco%20Secure%20Access%20(Instagram).png)](https://blog.iptel.com.au/managed-services-d6-cisco-secure-access)current generation Cisco network; applying a combination of enhanced analytics to detect malware and ensure crypto compliance. SNA is teamed up with Cisco Cognitive Analytics, which is a cloud-based service and comes back with an analysis as to whether that traffic is malicious or not. Think of this as machine learning on a global scale that is basically helping you with the fidelity of detecting malicious traffic within encrypted sessions. ETA means that you can investigate threats faster and resolve network security incidents in encrypted traffic with higher precision. Threat inspection, including data integrity checks on encrypted traffic. ### TrustSec Matrix Analytics Reporting A very powerful use-case is being able to visualise users and devices that are communicating with each [![Cisco AI Analytics in Operation (Instagram)](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Cisco%20AI%20Analytics%20in%20Operation/Cisco%20AI%20Analytics%20in%20Operation%20(Instagram).png?width=200&height=200&name=Cisco%20AI%20Analytics%20in%20Operation%20(Instagram).png)](https://blog.iptel.com.au/cisco-ai-analytics-in-operation)other, meaning it can highlight possible policy violations; it can show you devices that shouldn’t be allowed to communicate with each other! Once identified, it even allows you to simulate any policy changes in a passive manner before pushing those changes out into the network. This is achieved thanks to Cisco ISE and its identity-based capabilities; Security Group Tags are an identity-based way to manage policy and access controls. Meaning we can de-couple from needing to rely on the IP address of a user or device to enforce policies, but rather move into a framework based on the identity of a user or device. ### Cisco ISE The ability to move away from traditional methods to manage access control (IP addresses and network ACLs) and into an identity-based approach is crucial for modern organisations that have users connecting from anywhere and from any device; ISE allows us to enforce consistent policies for users and devices regardless of which IP address or subnet they connect from. From here, using SNA to glean a 360-degree view of client connectivity sessions, we can achieve detailed contextual awareness and correlation into network connections. Related reading - [Meraki Cloud Wi-Fi](https://blog.iptel.com.au/meraki-cloud-wifi) - [Cisco Meraki Wireless Overview](https://blog.iptel.com.au/cisco-meraki-wireless-overview) - [Meraki Made Simple](https://blog.iptel.com.au/blog/meraki-made-simple-meet-dave) - [Cisco Meraki Dashboard](https://blog.iptel.com.au/cisco-meraki-dashboard) --- ## Cisco Secure Network Analytics: FAQs ### What Is Cisco Secure Network Analytics? Cisco Secure Network Analytics uses flow telemetry such as NetFlow from your switches, routers and firewalls to learn normal network behaviour, then alerts on anomalies that suggest malware, data exfiltration or insider threats. ### Is Secure Network Analytics the Same as Stealthwatch? Yes. Cisco renamed Stealthwatch to Secure Network Analytics. The architecture and features carried over, so references to Stealthwatch in older material describe the same product. ### What Are the Main Components? The core components are the Manager, which provides the console and analytics, and Flow Collectors, which receive and store telemetry. Flow Sensors add visibility where devices can't export flows, and a UDP Director can forward telemetry to several destinations. ### Why Use Network Analytics as Well as a Firewall? Firewalls mostly watch traffic entering and leaving the network. Network analytics watches traffic inside it, so it can spot an infected device or unusual data movement between internal systems that a perimeter firewall never sees. --- ## Cisco Secure Network Analytics: Summary As threats continue to evolve, perimeter-based solutions cannot be 100 percent effective. You need a solution that can detect advanced threats early in the attack lifecycle and before they are able to [![Enhancing Network Security Cisco Umbrella (Instagram Post)](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Enhancing%20Network%20Security%20Cisco%20Umbrella/Enhancing%20Network%20Security%20Cisco%20Umbrella%20(Instagram%20Post).png?width=200&height=200&name=Enhancing%20Network%20Security%20Cisco%20Umbrella%20(Instagram%20Post).png)](https://blog.iptel.com.au/enhancing-network-security-cisco-umbrella)compromise your network and create a significant impact. In this blog, we have given an overview of SNA and how it can improve your threat response capabilities and get a comprehensive view of incidents within your network. We have run through the components you need to build out a working Cisco SNA install, and more importantly the use cases that SNA can support. Cisco SNA is all about giving you peace of mind that you have an advanced tool watching for unexpected activity on your network. When a departure from your usual baseline occurs, SNA can alert you on that, so you can take the relevant action. Related reading - [Cisco Meraki Access Points](https://blog.iptel.com.au/cisco-meraki-access-points) - [Cisco Meraki Switching](https://blog.iptel.com.au/cisco-meraki-switching) If you need any help with your [Cisco Secure Network Analytics implementation, we can help.](https://iptel.com.au/contact-us/) ### Need Help With Network Security? IPTel's [Cisco security](https://iptel.com.au/technologies/security-and-cisco-ise) engineers can review your visibility and threat detection, or start with our free [Security Assessment](https://score.iptel.com.au/security-assessment). If that would be useful, [get in touch with the IPTel team](https://iptel.com.au/contact-us) or email [sales@iptel.com.au](mailto:sales@iptel.com.au). #### Related Articles ###### [Securing your Cisco Wireless Network](https://blog.iptel.com.au/securing-your-cisco-wireless-network) Mar 12, 2026 ###### [Cisco AI Analytics in Operation](https://blog.iptel.com.au/cisco-ai-analytics-in-operation) Sept 4, 2026 ###### [Network Assessment Tool](https://blog.iptel.com.au/network-assessment-tool) Mar 31, 2026 Free tool ### How Many Wi-Fi Access Points Do You Need? Work out APs, PoE and switch ports floor by floor, using the same survey grades our Cisco wireless engineers design to. Takes under a minute. [Try the AP Estimator →](https://iptel.com.au/resources/wifi-access-point-estimator?utm_source=blog&utm_medium=cta&utm_campaign=ap-estimator) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "IPTel Solutions", "url" : "https://blog.iptel.com.au/author/iptel-solutions" }, "dateModified" : "2026-10-03T07:45:21.721Z", "datePublished" : "2025-10-10T02:57:06.000Z", "headline" : "Cisco Secure Network Analytics (Stealthwatch) Explained", "image" : [ "https://blog.iptel.com.au/hubfs/Blogs/Cisco%20Secure%20Network%20Analytics/Cisco%20Secure%20Network%20Analytics%20(Instagram%20Post).gif" ], "mainEntityOfPage" : { "@id" : "https://blog.iptel.com.au/cisco-secure-network-analytics", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.iptel.com.au/hubfs/IPTel_Solutions_February2020%20-%20Header%20SiteMap/Images/IPTellogo-byline-2020-dark-v2.png" }, "name" : "IPTel Solutions Pty Ltd" } } ```