Manage Stealthwatch Security Analytics

Review the Status of Sites and Fabrics

With Stealthwatch Security Analytics, you can view the status of the devices for each site or fabric.

Procedure

Step 1

From the top-left corner, click the menu icon and choose Provision > Stealthwatch Security Analytics.

Step 2

In the left pane, drill down to the site or fabric for which you want to view the status.

The card for the site or fabric indicates whether it is Deployed (full green circle) or Ready to deploy (open green circle).

Step 3

To view device-specific status, click a site or fabric card to view the devices that are Ready, Not Ready, or Enabled, and then click the corresponding tab.

The following are the different statuses for the devices in a particular site or fabric:

  • Enabled Devices: These devices have Stealthwatch Security Analytics enabled.

  • Not ready Devices: These devices have failed either one or more of the prechecks. The green check marks indicate the prechecks that the device has passed, while the red icons indicate the precheck that the device has failed. Hover your cursor over the red icon to view more information about the failed checks. See Review the Status of Sites and Fabrics.

  • Ready Devices: These devices pass all the prechecks, and can be enabled for Stealthwatch Security Analytics. See Review the Status of Sites and Fabrics.

View Scheduled Tasks

Procedure

Step 1

From the top-left corner, click the menu icon and choose Activity > Scheduled Tasks.

A list of completed and scheduled tasks is displayed.

Step 2

Use the FILTERS drop-down list to view only Stealthwatch Security Analytics tasks.

From here, you can view the list of scheduled and completed tasks. Click a task to view more information about it or to reschedule the task.

Update Stealthwatch Security Analytics

With Stealthwatch Security Analytics, you can update the configurations on devices that have previously been enabled, because changes to the network can occur over time.

Procedure

Step 1

From the top-left corner, click the menu icon and choose Provision > Stealthwatch Security Analytics.

Step 2

In the left pane, drill down to the site or fabric for which you want to update Stealthwatch Security Analytics. Alternatively, you can use the search bar to search for the site or fabric.

Step 3

Select the site or fabric for which you want to update Stealthwatch Security Analytics by clicking the site card.

The site card displays the number of devices that are Enabled, Ready, and Not Ready.

Note

 

At least one device must be enabled for you to update Stealthwatch Security Analytics.

Step 4

Click Get Started.

Step 5

Review the flow destination setup for the selected site or fabric. If you want to change the flow destination, click Change Settings. Set a new flow destination and restart the workflow.

If you see the error Select a flow destination for the site to proceed, click Update Settings to set a flow destination. Restart the workflow.

Step 6

Click Next.

Step 7

Ensure that the Enabled tab is selected in the device table.

Step 8

Click the Update radio button.

Note

 

Updating devices configures only what needs to be updated on the relevant network devices. For example, if 10 access interfaces had previously been enabled and there is one interface that is now relevant, updating the device only pushes a configuration change to the one new interface.

Updating the device includes the following:

  • A new line card is added

  • Changes are made to interfaces that have access points plugged in

  • Changes are made to VLANs

Step 9

Click the corresponding radio button to update Stealthwatch Security Analytics immediately (Now), or at a later time (Later).

Note

 

If you have chosen to update Stealthwatch Security Analytics at a later time, you can edit the scheduled time from Activity > Scheduled Tasks in the main menu.

Step 10

Click Apply.

Step 11

You can view the status of your deployment from Activity > Scheduled Tasks in the main menu.

After your task is complete, the status of the deployment changes from In Progress to Success.

Note

 

To ensure that you're viewing the updated status, click the Refresh button in the top-right corner of the Notifications list.

Disable Stealthwatch Security Analytics

Procedure

Step 1

From the top-left corner, click the menu icon and choose Provision > Stealthwatch Security Analytics.

Step 2

In the left pane, drill down to the site or fabric for which you want to disable Stealthwatch Security Analytics. Alternatively, you can use the search bar to search for the site or fabric.

Step 3

Select the site or fabric for which you want to disable Stealthwatch Security Analytics by clicking the site card.

The site card displays the number of devices that are Enabled, Ready, and Not Ready.

Note

 

At least one device must be enabled for you to disable Stealthwatch Security Analytics.

Step 4

Review the prechecks and click Get Started.

Step 5

Review the flow destination setup for the selected site or fabric. If you want to change the flow destination, click Change Settings. Set a new flow destination and restart the workflow.

If you see the error Select a flow destination for the site to proceed, click Update Settings to set a flow destination. Restart the workflow.

Step 6

Click Next.

Step 7

Ensure that the Enabled tab is selected in the device table.

Step 8

Use the toggle switch to exclude all or specific devices.

Step 9

Click the Disable radio button.

Step 10

Click the corresponding radio button to disable Stealthwatch Security Analytics immediately (Now), or at a later time (Later).

Note

 

If you have chosen to disable Stealthwatch Security Analytics at a later time, you can edit the scheduled time from the Notifications list in the upper-right corner of the screen by clicking Edit.

Step 11

Click Apply.

Step 12

You can view the status of your deployment from the Scheduled Tasks tab under the Notifications list.

After your task is complete, the status of the deployment changes from In Progress to Success.

Note

 

To ensure that you're viewing the updated status, click the Refresh button in the top-right corner of the Notifications list.