2019-06-17T08:45:00Z

What needs improvement with Cisco Stealthwatch?


Please share with the community what you think needs improvement with Cisco Stealthwatch.

What are its weaknesses? What would you like to see changed in a future version?

Guest
3131 Answers

author avatar
Consultant

The usability of this solution needs to be improved. The initial setup of this solution can be simplified.

2019-09-23T06:34:00Z
author avatar
Real User

We're trying to upgrade to the newest release. We're running a version that's three versions behind.

2019-07-02T06:57:00Z
author avatar
Real User

I would like to see better filters. You should be able to filter the data out to more rapidly find what you're looking for.

2019-07-02T06:57:00Z
author avatar
Top 20Real User

There are already many functionalities, so I don't think there is anything to improve. Its the best one on the market I have seen.

2019-06-23T09:40:00Z
author avatar
Real User

The overall visibility into the actual device itself would be helpful. I don't just want support-specific data, but also to be able to see information such as CPU and other internal components or usage of the devices.

2019-06-17T08:46:00Z
author avatar
Top 20Real User

The initial setup is complex, as there is a lot to configure.

2019-06-17T08:46:00Z
author avatar
Real User

The GUI could use some improvement. Being able to find features more easily would be a great improvement if it was simplified.

2019-06-17T08:46:00Z
author avatar
Real User

There is room for this solution to mature because there are still things that we want to see. The reporting of day-to-day metrics still has room for improvement.

2019-06-17T08:46:00Z
author avatar
Real User

It is time-consuming to set it up and understand how the tool works.

2019-06-17T08:46:00Z
author avatar
Consultant

I would like this product to have better integration with Cisco Firepower. That is the easiest way to pair. Eliminating Java from the SMC would improve this solution. It would be better to let people know, upfront, that is doesn't give you nice, clear information, as seen in the demos, without Cisco ISE installed. Most of my customers are ISE-based so it doesn't matter, but I have to break the news to the ones who are not.

2019-06-17T08:46:00Z
author avatar
Top 20Real User

Some of our customers find this solution to be a little bit tough because they don't understand how to configure and use it. It may have to do with a need for more education when installing the product. Speed is an issue because the faster you have visibility, the better the solution.

2019-06-17T08:46:00Z
author avatar
Top 20Real User

I would like to see more and cleaner reporting. For example, if I pull up Steven and I want to look and maybe compare him to what you've done in the past week, and compare that to the past six months, the point would be to see what the difference in activity looks like over this time. I don't see that capability in reporting to date. You see that trend but you don't really see a straightforward comparison. That right there is key to what we want to see about the normal activity.

2019-06-17T08:46:00Z
author avatar
Real User

I would like to see more expansion in artificial intelligence and machine learning features. There does not seem to be much available in terms of training for the product. We use several training institutions, and this solution is not on any of their lists.

2019-06-17T08:46:00Z
author avatar
Real User

I think the interface is a little lacking. The interface seems like it just needs to be modernized. It's been the same interface now, ever since I've seen it probably four years ago.

2019-06-17T08:46:00Z
author avatar
Real User

One thing I would like to see improved is if it could automatically be tied through ISE, instead of you having to manually get notifications and disable it yourself. I am the only network admin at my facility, and when I'm on vacation for a week and there is an attack, I'm the only individual that gets alerts. Essentially there's a push button that you click to implement the policy through ISE to block that host or some other network essentially segregated from your internal network. I would like to see an automatic block function. I haven't noticed any downfall as far as CPU usage or any congestion, but it is still too early to say. Once I get a better understanding of it and get past the baselining, I can probably answer better and in more depth, because I don't know everything about it. I just understand the fundamental idea of it and what I can do from the dashboard.

2019-06-17T08:46:00Z
author avatar
Top 20Real User

Complexity on integration is not so straightforward and you really need an expert to help build it out.

2019-06-17T08:46:00Z
author avatar
Top 20Real User

Stealthwatch needs improvement when it comes to speed.

2019-06-17T08:46:00Z
author avatar
Real User

I don't really think we really save time while using this solution.

2019-06-17T08:46:00Z
author avatar
Real User

We're still gathering numbers about our increased threat detection rate. Anything we can improve with security patches to the network greatly improves the product. There's a lot of traffic on our network that we don't see sometimes.

2019-06-17T08:45:00Z
author avatar
Real User

I would like to see some improvement when it comes to reporting.

2019-06-17T08:45:00Z
author avatar
Consultant

I would like to see a hybrid solution that can work without being connected directly to the internet for those destinations. A business case would be manufacturing floors that are not, or still not, connected to the internet permanently. In terms of the user interface, navigating through the drill down windows needs to be improved.

2019-06-17T08:45:00Z
author avatar
Real User

They should include Citrix VDIs in the next release.

2019-06-17T08:45:00Z
author avatar
Real User

We had some trouble with the installation as we migrated from our previous solution.

2019-06-17T08:45:00Z
author avatar
Real User

At my company, we might not be using it enough with other applications that we have that can integrate with it. We need integration between ISE and Stealthwatch. I know my company is trying to get it to work. I don't know if they actually got it yet.

2019-06-17T08:45:00Z
author avatar
Real User

It's too complicated to install when starting out. Also, we have actually seen an increase in false positives with Stealthwatch. A few of the false positives were too early to detect. Availability is another issue. You need a couple of days to get it to work.

2019-06-17T08:45:00Z
author avatar
Real User

Considering all the data on the network, I believe that the analytics of Cisco Stealthwatch are pretty decent. I would like to see it better organized when I'm looking at it. If I hand it to another NOC engineer, they may not know what they're looking at, so I would prefer it to be more clean and structured, making it easier to use.

2019-06-17T08:45:00Z
author avatar
Top 20Real User

Cisco Stealthwatch needs more integration with device discovery. We have to do a lot of hard work to figure out what things are. Better service integration is required.

2019-06-17T08:45:00Z
author avatar
Real User

We are continuing down the road of ACI and ISE with Cisco, so we would like to see the continuation of Stealthwatch integrating into ISE for exchange of information, and also, more into the ACI environment too.

2019-06-17T08:45:00Z
author avatar
Real User

I don't have a specific feature request, but my big push with Cisco has always been to make it easier for the administrators to use it. If you look at other products that they've been really successful within software space like Meraki, it's because a customer can jump right in and use it on day one and feel like they're accomplishing something with it. They don't have to have a Ph.D. Anything that we can do to make the customer experience better makes it easier for them to use it, which is what we want, and it also makes it easier for us to sell it. Obviously usability, but given the space that it plays in, any way that we can continue to increase the security vector coverage is always going to be a net gain for a product like that.

2019-06-17T08:45:00Z
author avatar
Real User

The ability to be natively integrated into Port Aggregator would be beneficial because it would reduce just one more component that's needed in order to have that type of view.

2019-06-17T08:45:00Z
author avatar
Real User

We don't use Cisco Stealthwatch for threat detection. We use it more for information gathering. We use better options for threat detection, i.e. Palo Alto firewalls for our security. I would like the search page available with Cisco Stealthwatch to be more intuitive. The previous release was better than the current one for the UI. We moved to the latest UI a couple of months ago, maybe like six months ago. I'm not a fan. I wish the search options were easier.

2019-06-17T08:45:00Z
Learn what your peers think about Cisco Stealthwatch. Get advice and tips from experienced pros sharing their opinions. Updated: April 2020.
441,726 professionals have used our research since 2012.