Co-authors: Lou Norman and Erich Stokes
Functions and the Advantages of Community Telemetry
Welcome to Half 3 of this weblog sequence “Defining Community Telemetry.” On this part, we’ll talk about the true worth of community telemetry and discover its wide-raging functions. By leveraging telemetry knowledge, organizations can obtain important enhancements in community administration and safety.
To recap, in Half 1, we mentioned how community telemetry is a transformative software for the US Public Sector, offering complete insights into community efficiency, safety, and utilization patterns.
In Half 2, we mentioned how community telemetry performs a vital position in enhancing safety response instances by offering detailed insights into community actions.
As we dive deeper in Weblog 3, proceed to think about telemetry knowledge like a Golden Nugget for a community administrator. Simply as a prospector sifts via dust to seek out valuable metals, analyzing telemetry knowledge to extract priceless data can improve community safety and efficiency. Think about the immense worth when a community administrator uncovers hidden insights inside a community and discovers gold.
Harnessing the Energy of Telemetry
The true worth of community telemetry lies in its functions. By leveraging telemetry knowledge, organizations can obtain:
- Enhanced Community Visibility: Telemetry supplies real-time insights into community efficiency, permitting organizations to observe site visitors patterns, detect anomalies, and optimize community sources. This visibility is essential for figuring out potential points earlier than they escalate into main issues.
- Improved Safety Posture: Telemetry knowledge permits proactive risk detection by constantly monitoring community actions and figuring out deviations from regular conduct. This functionality helps in lowering response instances to safety incidents and enhances the general safety operations by offering detailed insights into community actions.
- Environment friendly Community Administration: With telemetry, organizations can automate community administration duties, comparable to site visitors engineering and capability planning, by utilizing detailed knowledge on community utilization and efficiency. This automation reduces guide intervention and improves the effectivity of community operations.
Telemetry and the Cisco Safety Portfolio
Instruments like Safe Community Analytics (SNA), Telemetry Dealer, XDR, Safe Workload, ThousandEyes, Catalyst Heart, Meraki Dashboard, Id Providers Engine (ISE), Hypershield, and Splunk eat telemetry knowledge to detect anomalies, establish threats, and supply actionable insights for safety groups.
Cisco Safety Portfolio – Telemetry Utilization
| Utility Knowledge | |
| Cisco Safe Workload | Cisco Safe Workload leverages telemetry knowledge to supply complete visibility into software workload flows and interactions. By gathering metadata moderately than full packets, the platform ensures low bandwidth utilization whereas providing detailed insights into communication patterns and dependencies throughout on-premises and cloud environments. This telemetry knowledge is essential for figuring out coverage violations and potential threats, enabling organizations to take care of compliance and cut back the assault floor in complicated, hybrid multi-cloud environments.
Safe Workload’s capacity to course of telemetry knowledge rapidly permits for real-time monitoring and alerts in opposition to unauthorized conduct. Safe Workload integrations guarantee constant coverage enforcement from the info middle to the cloud, enhancing the platform’s capacity to supply a holistic view of the community. This integration helps agile software improvement and deployment whereas sustaining a robust safety posture. |
| Cisco Hypershield | Cisco Hypershield leverages superior telemetry knowledge to boost safety by integrating AI-native structure immediately into community and workloads. This integration is facilitated via Tesseract Safety Brokers and network-based enforcers, which give deep visibility and enforcement capabilities. These elements monitor community connections, file and system calls, and kernel features, producing event-based telemetry that’s processed in real-time. This telemetry knowledge is used to assemble behavioral graphs, that are dynamic fashions of community conduct that allow software fingerprinting and inform risk detections. By processing telemetry immediately on the edge, Hypershield minimizes knowledge load and enhances real-time decision-making, lowering risk detection and response instances.
Hypershield’s twin knowledge aircraft know-how permits for the testing and validation of latest software program upgrades or coverage modifications utilizing dwell site visitors with out impacting the manufacturing surroundings. This strategy ensures that updates may be deployed extra often and with higher confidence, sustaining strong defenses in opposition to rising threats. The system’s AI-powered administration automates safety coverage lifecycles and infrastructure upgrades, permitting safety groups to work extra effectively by automating complicated evaluation and decision-making processes whereas sustaining human oversight. This complete use of community telemetry ensures that Hypershield supplies steady safety and excessive efficacy in risk detection and response. |
| Community Cloud | |
| Cisco Safe Community Analytics (SNA) | Cisco SNA leverages the facility of community telemetry by utilizing it as a wealthy knowledge supply to supply complete visibility throughout the whole community, together with non-public and public clouds. By analyzing community actions, it creates a baseline of regular conduct and employs superior analytics, together with behavioral modeling and machine studying, to detect anomalies and threats in real-time.
This agentless resolution makes use of present community infrastructure to observe site visitors, even when encrypted, enabling organizations to detect threats comparable to Command-and-Management assaults, ransomware, and insider threats with excessive confidence. This strategy transforms the community right into a proactive safety sensor, enhancing risk detection and response capabilities with out the necessity for added probes or sensors. |
| Cisco Id Providers Engine (ISE) | Cisco ISE harnesses the facility of community telemetry by integrating intelligence from throughout the safety stack to turn into the coverage determination level in a zero-trust structure. This integration permits Cisco ISE to robotically uncover, profile, authenticate, and authorize trusted endpoints and customers connecting to the community infrastructure. By leveraging telemetry knowledge, Cisco ISE can dynamically develop and preserve risk-based insurance policies that guarantee solely trusted customers and gadgets acquire entry to community sources. This strategy strikes safety past preliminary authentication, sustaining belief all through the whole session.
Safe Community Analytics (SNA) integrates with Cisco ISE and enhances community visibility and management. This integration permits directors to constantly monitor, analyze, and categorize host and person data from the community. SNA can detect anomalous behaviors and situation alerts, enabling speedy risk containment via Cisco ISE. This functionality supplies a complete view of community exercise, serving to to establish a variety of threats, together with malware and insider threats, thereby enhancing general safety posture. Cisco ISE can incorporate and share this contextual details about endpoints with different Cisco merchandise and over 200 different distributors resolution to complement and quantify resolution efficacy for making crucial choices on whether or not site visitors is malicious so it may be blocked in actual time. |
| Splunk | Splunk, in collaboration with Cisco Safe Community Analytics (SNA), leverages community telemetry to boost safety by utilizing the community as a sensor. This strategy permits SNA to eat movement knowledge immediately from the infrastructure, offering complete visibility into community actions with out extra probes or sensors. The mixing of superior behavioral analytics and machine studying permits the identification of suspicious and malicious actions, delivering high-fidelity safety insights immediately into the Splunk platform. This functionality reduces knowledge volumes by compressing uncooked community telemetry, making it simpler for safety groups to grasp and reply to threats successfully.
Moreover, the seamless integration of SNA with Splunk Enterprise Safety (ES) enhances risk detection and incident response capabilities with out rising prices. This unified resolution is good for enterprises with mature safety operations, regulated industries, and authorities businesses, providing a complete, cost-effective strategy to community safety and incident response. By supporting AWS and Azure telemetry, the answer additionally supplies safety for hybrid environments, making certain strong safety throughout each on-premises and cloud infrastructures. |
| Cisco Telemetry Dealer | Cisco Telemetry Dealer is a robust software designed to optimize the administration of community telemetry knowledge. It acts as a utility to duplicate, rework, and filter community telemetry flows, thereby simplifying the consumption of telemetry knowledge for business-critical instruments. The dealer can route and replicate telemetry knowledge from a supply location to a number of vacation spot shoppers, permitting for fast on-boarding of latest telemetry-based instruments. It additionally supplies fine-grain management over what knowledge shoppers can see and analyze by filtering pointless knowledge, which might help cut back prices related to sending knowledge to costly instruments. Cisco Telemetry Dealer transforms knowledge protocols from the exporter to the patron’s protocol of selection, enabling instruments to eat a number of knowledge codecs seamlessly.
One of many key options of the Cisco Telemetry Dealer is its capacity to remodel AWS VPC movement logs and Azure NSG movement logs into IPFIX format, which may then be ingested into Cisco Safe Community Analytics (SNA) on-premises. This transformation functionality expands the info assortment capabilities of Safe Community Analytics by permitting it to ingest and analyze community telemetry from nonstandard sources. By changing these cloud-based telemetry sources right into a format suitable with on-premises instruments, the Cisco Telemetry Dealer enhances visibility and evaluation capabilities throughout hybrid cloud environments. This performance is essential for organizations seeking to preserve complete community safety and efficiency monitoring throughout numerous environments. |
| Cisco Meraki Dashboard | The Cisco Meraki Dashboard harnesses the facility of community telemetry by offering an intuitive and interactive net interface that connects customers to a number one cloud IT platform. This platform permits for complete community administration and monitoring, providing real-time insights into community efficiency and well being. By leveraging telemetry knowledge, the Meraki Dashboard permits directors to achieve visibility into community site visitors, machine standing, and software efficiency, which facilitates proactive community administration and troubleshooting. This functionality is essential for sustaining optimum community efficiency and making certain a seamless person expertise. The Meraki Dashboard integrates superior options comparable to synthetic intelligence and machine studying to boost community administration. These applied sciences optimize community effectivity, automate administration duties, and reduce potential bottlenecks throughout peak utilization instances. The dashboard’s capacity to supply detailed telemetry knowledge helps sustainability initiatives by permitting directors to observe and handle power utilization successfully, thus contributing to organizational sustainability objectives. This integration of telemetry with AI-driven insights ensures that community operations are usually not solely environment friendly but in addition aligned with broader enterprise targets. Moreover, the combination between Cisco XDR and Meraki MX creates a bi-directional movement of data, enhancing each safety and community operations by offering priceless insights and enabling proactive risk monitoring. |
| XDR/Menace Intelligence | |
| Cisco XDR | Cisco XDR leverages community telemetry by gathering and correlating knowledge from numerous sources, together with on-premises networks and public clouds. This allows the identification of hosts, understanding of regular host conduct, and technology of alerts when machine conduct modifications in a fashion related to community safety. By ingesting public cloud logs and integrating with Cloud Service Supplier APIs, Cisco XDR can detect adversary conduct and infiltrate deep into a corporation’s cloud surroundings. The XDR Connector ingests community telemetry from sources like movement knowledge and NGFW log data, sending it to a SaaS-based knowledge repository for evaluation and correlation, which boosts risk detection and response capabilities. Cisco XDR’s integration capabilities lengthen throughout a number of safety domains, together with community, cloud, endpoint, electronic mail, identification, and functions, offering unified visibility and deep context into superior threats. This integration helps cut back time-consuming false positives and enhances the effectivity of safety operations. The Cisco Safe Cloud Analytics (SCA) Community Detection and Response (NDR) has been built-in into Cisco XDR as an embedded element, enhancing risk detection capabilities by incorporating agentless behavioral and anomaly detection. The NDR element inside XDR makes use of historic community knowledge to enhance risk looking, forensic audits, and incident response. Cisco’s XDR/SCA options are designed to ingest NetFlow, IPFIX, and ETA knowledge from on-premises Cisco Telemetry Dealer (CTB), offering complete visibility and analytics capabilities. The CTB facilitates the transformation of AWS VPC and Azure NSG movement logs into IPFIX format, enabling seamless integration with on-premises safety instruments. This functionality extends to cloud environments, together with AWS, GCP, and Azure, making certain that numerous telemetry knowledge may be successfully utilized for enhanced safety monitoring and risk detection. |
| Networking | |
| Cisco ThousandEyes Site visitors Insights | The Cisco ThousandEyes Site visitors Insights leverages telemetry knowledge to supply complete visibility into community efficiency and safety. By gathering and analyzing telemetry knowledge, ThousandEyes can monitor site visitors flows throughout numerous community layers, together with the web, cloud, and enterprise networks. This knowledge is essential for figuring out efficiency bottlenecks and potential safety threats, permitting organizations to proactively handle and optimize their digital experiences.
Telemetry knowledge, which incorporates statistics, occasion information, and logs, is used to achieve insights into community conduct and efficiency. This knowledge helps in establishing a baseline of regular community exercise, which is crucial for detecting anomalies that would point out safety threats. By constantly monitoring and analyzing this knowledge, ThousandEyes can present actionable insights that assist in lowering the imply time to establish and resolve points, thereby enhancing the general safety posture of a corporation. |
| Cisco Catalyst Heart | Cisco Catalyst Heart leverages community telemetry to boost community administration and operational effectivity. By using telemetry, Catalyst Heart supplies a centralized platform for monitoring and managing community efficiency. It collects and analyzes knowledge from numerous community gadgets, comparable to routers and switches, to supply real-time insights into community well being and efficiency. This steady streaming of telemetry knowledge permits for proactive identification and backbone of community points, lowering downtime and enhancing general community reliability. The platform’s capacity to combine with third-party functions additional enhances its capabilities, enabling automated workflows and improved IT operations.
Catalyst Heart’s use of telemetry extends to safety and compliance. By offering detailed visibility into community site visitors and machine conduct, it helps in detecting and mitigating safety threats. The telemetry knowledge is used to determine baselines of regular community conduct, permitting for the identification of anomalies that will point out potential safety breaches. This functionality is essential for sustaining a safe community surroundings, because it permits steady monitoring and fast response to threats. The mixing of telemetry with Cisco’s broader safety options ensures that community safety is maintained with out compromising efficiency. |
Unleashing the Energy of Telemetry
Now that you simply perceive the worth of community telemetry and the way it integrates with the Cisco Safety portfolio serving to you obtain important enhancements in community administration and safety, we will transfer ahead and clarify how one can unleash the facility of telemetry – particularly for the wants of the general public sector.
Optimize Community Efficiency
Optimizing community efficiency entails leveraging community telemetry knowledge to achieve complete insights into the community’s operational standing. Telemetry knowledge supplies real-time visibility into community site visitors, machine conduct, and software efficiency, permitting community directors to observe and troubleshoot points successfully.
By constantly streaming knowledge from community gadgets, telemetry permits the identification of bottlenecks and potential efficiency points earlier than they affect the community’s effectivity. This proactive strategy permits for well timed interventions, comparable to adjusting site visitors flows or upgrading infrastructure, to make sure optimum community efficiency.
Moreover, community telemetry knowledge performs a vital position in planning for future progress. By analyzing historic and real-time knowledge, community directors can forecast useful resource wants and optimize capability planning. This ensures that the community can accommodate rising calls for with out compromising efficiency.
Telemetry knowledge additionally aids in understanding utilization patterns and traits, enabling knowledgeable choices about scaling community infrastructure and deploying new applied sciences. Total, using telemetry knowledge in community efficiency optimization results in a extra resilient, environment friendly, and scalable community surroundings.
Enhance Operational Effectivity
Bettering operational effectivity entails leveraging detailed insights into community utilization and efficiency to streamline operations, cut back prices, and improve person experiences. By analyzing community knowledge, organizations can establish inefficiencies and bottlenecks, permitting them to optimize useful resource allocation and utilization.
This proactive strategy not solely minimizes waste but in addition ensures that community sources are used successfully, resulting in price financial savings. Moreover, enhanced visibility into community efficiency permits faster identification and backbone of points, lowering downtime and enhancing reliability. Consequently, customers expertise a extra seamless and responsive community, which contributes to general satisfaction and productiveness.
Conclusion
Community telemetry is a robust function embedded inside your Cisco community {hardware}, providing a wealth of insights that may rework your community administration and safety methods. By understanding and leveraging this Golden Nugget, organizations can unlock new ranges of effectivity, safety, and efficiency.
Empowering US Public Sector Clients with Telemetry
Cisco is devoted to empowering US public sector clients by providing strong community telemetry options. By complete help and revolutionary applied sciences, Cisco assists organizations in seamlessly integrating telemetry knowledge into their present workflows.
This integration permits for enhanced decision-making capabilities, enabling these organizations to proactively handle potential threats and optimize their operations.
By leveraging telemetry, public sector entities can acquire priceless insights into their community environments, making certain they continue to be safe and environment friendly of their operations. Cisco’s dedication to offering tailor-made options ensures that public sector clients can absolutely harness the facility of telemetry to satisfy their distinctive wants and challenges.
Assets
Share:
