Webinar Lobby

We will begin shortly.

This session will be recorded.

This presentation and the recording

will be posted in the Customer
Community and the Training Center.

https://lancope.force.com/Customer
Customer Exclusive:
We Asked, We Heard, We’re Taking Action
Brought to you by Customer Success Educational Services
Presented by:
Ken O’Reilly, Director of Customer Success at Cisco Systems
Jody Ma Kissling, Cisco Senior Marketing Manager
Dennis Thrift, Cisco Product Manager, Stealthwatch
January 26, 2017 / 1:00 – 2:00 pm ET
About Our Presenters

Ken O’Reilly Jody Ma Kissling Dennis Thrift

Director of Customer Success Senior Marketing Manager Stealthwatch Product Manager
Cisco Systems Cisco Systems Cisco Systems
kenoreil@cisco.com jkisslin@cisco.com dethrift@cisco.com
Did you participate in the TechValidate survey
from September/October? (Please select only
one answer.)
A. Yes
B. No
C. I don’t know
Today’s Session ...

• Your Voice: Customer Survey Results

• Our Response: Continuous Improvement is Paramount!
• What You Can Expect: Stealthwatch 6.9
• Over 50 Use Cases, Videos, and Webinars Available to Help You
• Q&A
What is Customer Success?

Helping customers achieve consistent, measurable, and exceptional

outcomes throughout their entire journey with Cisco Security.
The Security
Goal Effectiveness
for Effective Security Gap
How to Become More Secure
Superior Technology Architecture Customer Outcomes

Improve Reduce Accelerate

Efficacy Time to Detection Time to Value

Customer Success
“At Cisco you, our customers, are our number 1 priority. We can
only be successful if we’ve helped you be successful.”
– Chuck Robbins, CEO at Cisco
 Stealthwatch enhances visibility across your
entire business
Monitor Detect CISCO Analyze Respond
STEALTHWATCH
Extended Network Cloud

Branch Data Center

• Gain unique visibility • Enable your network to take action • Protect your critical information • Gain enhanced visibility
across your business • Extend visibility and granular access • Simplify policy enforcement into the cloud
• Simplify segmentation control to your remote branches and data center segmentation • Make the cloud a part
throughout your networks • Prevent the lateral movement of threats • Accelerate incidence response of your segmentation strategy
• Address threats faster in the data center • Identify threats quickly
and take action
Cisco Services and Customer Success
 Realize the value of enhanced visibility faster
Cisco Services
Maximize the value from your investments
Work with Cisco teams that have experience advising,
installing, integrating, and managing Cisco solutions
to get everything set up quickly and realize greater
overall value
SERVICES
Cisco Customer Success
Gain confidence in your new integrated solution
Receive proper on-boarding and training for the solution,
access to self-learning tools, and other outcome-based
services
You Spoke … We Listened!
Customer Survey Results
Who Participated?
Job Roles Organization Size
4% 2% 9%
6%
14% 3%

20% 7%

7%
57% 34%
6%
13%

C Level 18%
Fortune 500 S&P 500
Director/VP
Large Enterprise Medium Enterprise
Manager
Small Business Federal
Architect
State & Local Educational Institution
Admin/Analyst/Engineer

333 users across 239 companies

80% NA, 20% ROW
How are you using Stealthwatch?
agree -- Stealthwatch protects your previous investment by
83% allowing you do do more with your existing security tools!

Strong mix of security and network
use cases
Customers are using Stealthwatch
to monitor many different parts of
their network
Customers are looking to expand
their use of Stealthwatch
“NetFlow is highly valuable, but difficult to use
without post processing. Lancope is bloody
brilliant. Traverse network conversations, spin
up new searches based on those results, look
at fields relevant to the situation (e.g. RST,
latency, QoS labels), create groups to manage
networking or services. Most people
underutilize NetFlow, but it should be your go to
tool. Bang for the buck, I prioritize it first among
all my tools.”
-- Senior IT Architect, [Education Institution]
Top Deployment Considerations
Top Stealthwatch Use Cases
Using Stealthwatch to Enforce Policy
How Are We Doing?
How is Stealthwatch Helping You?
Your Top Challenges

Usability
Java-based Value
GUI
Support
Performance
What You Can Expect:
Stealthwatch 6.9
 Many of the products and features
described herein remain in varying stages
of development and will be offered on a
when-and-if-available basis.
Disclaimer This roadmap is subject to change at the
sole discretion of Cisco, and Cisco will
have no liability for delay in the delivery or
failure to deliver any of the products or
features set forth in this document.
Stealthwatch 6.9
Improve Efficacy -- Continually improving
the efficacy of analytics, reporting, and
notifications
• Directional policy
• Enhanced alarm category point
contributions
• Improved algorithm documentation
Common and Shared Services
• UDPD Managed by SMC -- Add
configuration and management of
UDP Directors to the SMC
Web UI Enhancements
• REST API

ISE 2.1 Integration -- Fully utilizing the • Host Group reports

PxGrid for integration to provide more • Associated Flow View
effective mitigation and user attribution to • Improved work flows and pivot
our flow data points
• User session data from pxGrid • Top Reports
• Integration with ISE-PIC • Enhanced flow query
• Improved mitigation through pxGrid
Dashboard Enhancements
Web UI Enhancements
• Number of Alarming Host
by category for Today and 7
day trend
• Top Alarming Host widget
for fast visual knowledge of
most critical host
• Horizontal navigation to
provide more screen real
estate for security
information
Host Group Report
Host Group Report
• Number of Alarming Host in the Host Group
by category for Today and 7 day trend
• Top Alarming Host in the Host Group for fast
visual knowledge of most critical host
• Summary of Host Group traffic with zoom
in/out graph with drill down to Flows, Top
Reports, ISE Mitigation, or External Lookup
• Top Applications for last 24 hours with zoom
in/out graph with drill down to Flows, Top
Reports, ISE Mitigation, or External Lookup
Top Reports
• Applications
• Services
• Ports
• Protocols
• Hosts
• Peers
• Conversations
New Flow Query Page
Flow Query Improvements
• Selectable report type (e.g., Flow
search / Top reports)
• Optional Connection setting to choose
only Bidirectional flows in results
• Custom name any search or report for
fast access in Job Management
• Ability to use “exclude” parameters in
criteria
Flow Search Results
Flow Table Improvements
• Quick visibility and edit
of query parameters
• Faceted Filter across all
fields in results
• Expand/Collapse Details
for each record
• Ability to manage
columns in table view or
switch to conversational
view
• Drill down to Top
Reports, ISE Mitigation,
or External Lookup
Associated Flow Query from Security Events
from the Web UI
Directional Policy
• Flexibility in terms of how a policy can be tuned
• Allows customers to turn off a policy JUST as the subject OR the target rather than
being forced to do all or nothing
• Providing more accurately - configured policies to reduce alarms by making exceptions
and exclusions
UDP Director Managed by SMC
New Documentation of Security Events
• Increasing customer knowledge of events and alarms
o What type of behavior does the event look for?
o What is the indication of the event when triggered?
o What alarm categories does the event contribute points?
o What information (details) are available from Stealthwatch?
o What potential actions should be taken with an alarm?
• New documentation is an effort that is spanning multiple releases
(including 6.8, 6.9, and later versions)
New Documentation of Security Events
What Have We Learned?
The Link Between Enablement and
Product Success
First and Foremost -- We Have Very Loyal
and Dedicated Customers!
rated your likelihood to recommend Stealthwatch to your
71% friends and peers an 8 or higher (with an average of 9)
“Stealthwatch assists with providing explicit proof of
successful or unsuccessful connections including
bi-directional. Event analysis time is greatly reduced by
immediate display if a client successfully communicated or
did not with a host. Stealthwatch also has provided us
a proven method for properly identifying “data
loss” out of our network.”
— Senior IT Architect,
Medium Enterprise Health Care Company
Stealthwatch “increased network visibility by
90%. It was the main tool we used to troubleshoot a
latency issue caused by our web filter.”
Clark County
“In case of incidents, [Stealthwatch] helps us to
find the root cause within minutes and
isolate the issue in the minute of panic.”
Salesforce
“Stealthwatch has helped us increase the visibility of our
network’s edge points by 75% and it does a wonderful job
in helping us to detect traffic anomalies in a few minutes. It has
saved us lots of money, but more importantly, it helps us to
maintain our priceless reputation as a very secure financial
services company!”
— Paul Rodin, Senior IT Architect,
Elavon Merchant Services
Link between Service Consumption and Product
Satisfaction/Success
Customers that consume more Customer Engagement vs. NPS Score
services rank Stealthwatch higher 30

25
Assets Most Consumed

Customer Engagement
Training > 1000 users 20

Webinars > 750 users 15

Use Cases > 800 downloads 10

Professional Services > 500 customers 5

Onboarding > 100 customers 0

in 2016 0 2 4 6 8 10 12
NPS Score
Link between Product Usage and
Product Satisfaction/Success
Customers that consume more services Customers that use more Stealthwatch
use more Stealthwatch capabilities capabilities are more likely to recommend
Stealthwatch to peers
Health Score
3.80 3.70 3.69
3.70 “Stealthwatch gives the most visibility
3.60 bang for configuration buck. You get more
3.50 usable information from just a few hours of
3.40 setup than any other monitoring product I’ve
3.30 ever seen”
3.20 3.14
3.10 Supervisory Network Analyst at State
3.00 Government Agency
2.90
2.80
Adoption
Customer Health
Time with Stealthwatch
Average Health Score
13% 16% 23.4
25
20.5
9% 20 18.6
16.9 17.3
15
10
26% 36% 5
0
Less than 1 Year 1 to 3 Years Less 1 to 3 4 to 6 7 to 9 10+
than 1 Years Years Years Years
4 to 6 Years 7 to 9 Years
Year
10+ Years
 Profile of a Successful Customer
 On current release
 Consumes product training and
professional services
 Takes eLearning modules
 Reviews uses case documents
 Attends at least one expert series
webinar and reviewed others
 Engages in the onboarding and
customer success maturity model
program
☐ Participates in Stealthwatch early
release program
☐ Attends regional user
group meetings
☐ Stays current on product roadmap
☐ Takes part in Stealthwatch
health checks
☐ Uses specific integrations
(e.g. host group automation,
SIEM integration)
Where Can You Go for Help?
 Customer Success Organization Framework

Mission: To provide the framework and associated services to enable customers to achieve
successful outcomes and long-term success with the Stealthwatch System.

Customer Success
Professional Services Operations
Customer
Stealthwatch-Professional Services@Cisco.com Stealthwatch-CustomerSuccess@cisco.com
Success
Team

Educational Services Customer Support

Stealthwatch-Training@Cisco.com Support@lancope.com
Complimentary Customer Resources
eLearning
• Flow the Basics
• Install and Configure
Stealthwatch
• Licensing Stealthwatch
• Stealthwatch SMC
Client Interface
• Stealthwatch SMC
• Web App
• Stealthwatch Overview
and Components
• Stealthwatch Health
and Maintenance
Account Management
• Highest level of customer success
• 1 to 6 CSM coverage
• Free moving to fee based
Learning Bytes On Demand Expert Series Webinars
• What’s New in 6.6? • Why Stealthwatch? • NetFlow Export
• What’s New in 6.7? • Basic Setup Troubleshooting
• What’s New in 6.8? • Host Groups • Demystify Characteristics of
• External Lookup Strange NetFlow
• Services and Applications
Conversations
• Proxy License (formerly • Network Devices and the By
Proxywatch) • Create Maps to Magnify
Function Host Group
Network Visibility
• Policy Management
• Detect Insider Threats and
Use Case Videos • User Management Targeted Attacks with the
• Data Loss • Custom Documents Web App
• Response Management • Inspect Network Traffic Flows
• Policy Violations
with Stealthwatch Document
• Reinforcing Firewall Policy Builder
• Detect Data Loss using
Year 1 On-Boarding Stealthwatch Advanced
Tuning
• For all new customers to help product adoption • Integrating Stealthwatch with
during the first critical year a SIEM
• 1 to 40 CSM coverage
• Free to all customers
Additional Services
Virtual Instructor-Led Training
• Stealthwatch for System Administrators
• Stealthwatch for Network Operations
• Stealthwatch for Security Operations
• Stealthwatch Advanced Tuning
• Proactive Hunting and Detection
Strategic Account Management
• Highest level of customer success
• 1 to 6 CSM coverage
• Free moving to fee-based
Advanced Services
• Security Deployment Service for StealthWatch Flow Collector 5000
• Security Deployment Service for StealthWatch
• Security Integration Service for StealthWatch
• Security StealthWatch Proxy Integration Service
• Security Host Group Automation Service for StealthWatch
• Security Health Check and Tuning Service for StealthWatch
• Security Optimization Service Cisco Security Plan and Build Services
How can you maximize your Stealthwatch?

1 2 3
Use your free resources and Get Involved and share your Upgrade to the latest version of
understand the breadth of feedback and influence the Stealthwatch to unlock the full
Stealthwatch capabilities product roadmap potential of your solution

© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 45
How can I get started? (Please select only one
answer.)
A. Join Beta
B. Join Mock SOC
C. Join Follow the Code
D. Become a reference today
E. Upgrade to the latest release
F. Call me
Q&A: Ask Our Speakers Anything!

Ken O’Reilly Jody Ma Kissling Dennis Thrift

Director of Customer Success Senior Marketing Manager Stealthwatch Product Manager
Cisco Systems Cisco Systems Cisco Systems
kenoreil@cisco.com jkisslin@cisco.com dethrift@cisco.com
Additional Resources Available at Your Finger Tips!

1. Log into the Customer

Community:
https://Lancope.force.com/
Customer
2. Sign up for Training.
3. Search our Knowledge
Base.
4. Check out our Use Cases.
Learning Opportunities via the Customer Community/Training Center!
Customer Community > My Training Customer Training Center
> • Free webinars
• Free eLearning
• Free OnDemand
• Free Learning Bytes
• Free video tutorials
https://Lancope.force.com/Customer • Fee-based Public/Private* Virtual Instructor-Led Training

*Please contact Stealthwatch-Training@Cisco.com

to set up a Private on-site class.
Upcoming Cisco Stealthwatch Expert Series Webinars
The Customer Success Educational Services team is pleased to offer our
customers a quick way to learn about tactical topics to maximize their Cisco
Stealthwatch deployment. Since it can be tough to squeeze learning in a day,
we’ve designed the webinar sessions* to deliver value in less than an hour.

February 2, 2017, 1:00 - 2:00 PM ET / 10:00 - 11:00 AM PT / 6:00 - 7:00 PM GMT

Practical Cisco Stealthwatch Host Group Tactics presented by David Brooks

March 2, 2017, 11:00 AM – Noon ET / 8:00 - 9:00 AM PT / 4:00 - 5:00 PM GMT

Encore Presentation: Detect and Triage Threats in the Enhanced Stealthwatch 6.9
Presenters: Matt Wolpers and Lance Hoskins
April 6, 2017, 1:00 - 2:00 PM ET / 10:00 - 11:00 AM PT / 6:00 - 7:00 PM GMT
[TBA]
*Registration invitations are Emailed to customers every month 2-3 weeks in advance.
 Customer Success Organization Framework
To provide the framework and associated services to enable
Mission customers to achieve successful outcomes and long-term success
with the Cisco Stealthwatch System.

Professional Services Customer Success

Operations
Stealthwatch-Professional Services@Cisco.com Stealthwatch-CustomerSuccess@cisco.com
Customer
Success
Team

Educational Services Customer Support

Stealthwatch-Training@Cisco.com Support@lancope.com
Thank You for Your Participation!
As you exit, please answer two quick questions!
Your feedback is valuable as it helps us plan future
webinar topics for which you would be most interested.