What is our primary use case?
We really just use the product for behavior analytics of our employees. When we have issues or when there is some type of an investigation from a security perspective, we pull up Stealthwatch and start trying to see what that user was doing. If there are any anomalies in their activities we have to take action to correct it.
We don't need to monitor every device. The reports show everything that person's doing and what device they're running, et cetera, and we really only need specific things.
That was one of our problems in the initial deployment. We tried to overcome that by redeploying. I'm not sure exactly sure that it helped a lot. We're getting more data, but I'm not really sure it gives us a true picture.
How has it helped my organization?
It has improved our internal knowledge of what's going on with the network, and that's helpful. Overall we like the product, I'm just not sure it's giving us everything that we can really get out of it right now.
What is most valuable?
The ability to see a real-time picture of the network is the most valuable for us.
What needs improvement?
I would like to see more and cleaner reporting. For example, if I pull up Steven and I want to look and maybe compare him to what you've done in the past week, and compare that to the past six months, the point would be to see what the difference in activity looks like over this time. I don't see that capability in reporting to date. You see that trend but you don't really see a straightforward comparison. That right there is key to what we want to see about the normal activity.
What do I think about the stability of the solution?
The product is very stable. No problems at all.
How are customer service and technical support?
I can't really comment on the customer service as that is not part of my turf. That's in the neck of the engineering team.
If you previously used a different solution, which one did you use and why did you switch?
There wasn't really a big decision making effort. The product came with the big suite of things that we purchased, so we decided to take advantage of it and deployed it.
How was the initial setup?
I was involved in the deployment. The initial setup should have been easier than it was — fairly easy overall. I think my engineering department made it more difficult. We should have deployed it based on the exact specifications of the vendor. On our team, we've got people who think they know more than the vendor. Any trouble goes back to our entire team not following the directions to the letter during the setup. They should have made sure they followed the exact steps to get everything running, and then actually go dig into any other need they're trying to solve for specifically. After that make sure to get reporting to match issues that are important to solve for because that's what makes it useful.
What about the implementation team?
We dealt directly with Cisco for the implementation.
What other advice do I have?
Overall the product is good. I'd give it a seven out of ten. That's mostly because of the deployment and then the reporting and trying to get the stuff out of it in a way that we want it.
Disclosure: I am a real user, and this review is based on my own experience and opinions.