SECURITY ATLAS / EVALUATION BRIEF Cisco Secure Network Analytics Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/cisco-secure-network-analytics/ THE ATLAS TAKE Secure Network Analytics is a worthwhile evaluation where the network can already supply useful flow telemetry and the SOC needs behavioral investigation across it. Its architecture offers a practical alternative to assuming every use case needs retained payloads. Atlas would test the quality of exporter fields, identity enrichment and investigation lookback before judging alert value. Flows can establish connections and timing; they cannot establish every command or file content. Manager, collectors, optional sensors and storage should therefore be selected around explicit investigation questions and the additional evidence responders can obtain elsewhere. SCOPE This is Secure Network Analytics, formerly Stealthwatch Enterprise. Evaluate Manager, Flow Collector, flow licensing and any Data Store or optional Flow Sensor explicitly. Secure Cloud Analytics and Cisco XDR are separate scope decisions. WORTH A LOOK WHEN Networks with suitable flow-export infrastructure and analysts comfortable combining metadata with other evidence. THINK TWICE WHEN The requirement depends on packet content or application detail the proposed flow design cannot supply. IMPLEMENTATION 1. Audit the exporter contract Capture representative records and check fields, directionality, sampling and time synchronization. 2. Size the investigation window Map expected flow rate and retention to the proposed collector and storage configuration. 3. Design the next-evidence handoff Document which endpoint, identity or packet source answers questions beyond connection metadata. OPERATING REALITY Network teams maintain exporters, sampling, timestamps and collection capacity while the SOC investigates observations. Address translation and shared infrastructure can complicate attribution. Retention and exporter health should be checked continuously because missing fields or sampled flows can change what an analyst can legitimately conclude. COMMERCIAL CONSIDERATIONS Quote the selected flow capacity and components, including any Data Store or Flow Sensor. Keep Secure Cloud Analytics and Cisco XDR outside the baseline unless explicitly included. - Licensed telemetry volume and collection capacity - Storage retention and optional sensors - Integration, exporter maintenance and investigation operations EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Build a timeline from synthetic internal flows Acceptance evidence: Retain exporter and sampling assumptions. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Validate attribution across a translated address Acceptance evidence: Document identity evidence and unresolved ambiguity. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Investigate a payload-dependent question Acceptance evidence: Identify exactly which additional telemetry is required. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - What flow rates, sampling and retention can the proposed design support? - Which observations require an optional Flow Sensor or identity integration? - How will investigators obtain packet or endpoint evidence when metadata is insufficient? EVIDENCE GAPS - Atlas has not independently benchmarked flow capacity or behavioral efficacy. - Confirm release-specific component support, retention and flow-license terms. SOURCES Cisco Secure Network Analytics (Product information) https://www.cisco.com/site/us/en/products/security/security-analytics/secure-network-analytics/index.html Cisco Secure Network Analytics components and licensing (Product information) https://www.cisco.com/c/en/us/products/collateral/security/stealthwatch/datasheet-c78-739398.html Cisco Secure Network Analytics configuration guides (Documentation) https://www.cisco.com/c/en/us/support/security/stealthwatch/products-installation-and-configuration-guides-list.html Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.