Cisco Endpoint Security Analytics (CESA) built on Splunk

Sep 6
19:22

2019

Calvyn Lee

Calvyn Lee

  • Share this article on Facebook
  • Share this article on Twitter
  • Share this article on Linkedin

Cisco info sack estimates that roughly 80% of the use cases they use CESA for would remain unaddressed without it. CESA anomaly and behavioural analysis will open your eyes to data loss, unapproved applications and SAAS, endpoint security evasion, unknown malware off-net user behaviour in zero-trust environments, endpoint asset inventory, creation of application and destination whitelists and blacklists and attribution of the user to the device to traffic and destination.

mediaimage

You are here,Cisco Endpoint Security Analytics (CESA) built on Splunk Articles at the centre of your organization's data, your network has vaulted in with a mountain of security features to keep your data safe, but there are a weak link, your users and their endpoint devices, you have endpoint blindness, the lack of clear visibility over your endpoints and user activity

Do you know what your users are doing? You should, you are one weak user password, undiscovered infection, free-spirited admin or disgruntled short-timer away from a breach. Cisco endpoint security analytics or CESA built on Splunk, offers the visibility needed to eliminate that endpoint blindness, cisco own info-security team uses CESA.

Cisco info sack estimates that roughly 80% of the use cases they use CESA for would remain unaddressed without it. CESA anomaly and behavioural analysis will open your eyes to data loss, unapproved applications and SAAS, endpoint security evasion, unknown malware off-net user behaviour in zero-trust environments, endpoint asset inventory, creation of application and destination whitelists and blacklists and attribution of the user to the device to traffic and destination.

CESA gives you the whole endpoint and user picture now you get the who, what, where, when, and how, all in one place. CESA leverages deep and detailed endpoint telemetry produced by Cisco anyconnect clients to provide visibility into users, traffic stats including destinations, direction and volume, software processes and applications, SAAS services used and machine details like OS version and device identity, but all that telemetry is worthless unless you have an engine that can analyze, detect, alert and respond, because CESA is built using Splunk it allows you to compare correlate and define parameters anomalies and usage.

CESA is also compatible with cisco ice and amp to enable quick threat containment CESA is completely customizable flexible and adaptable as your needs evolve CESA can be configured to meet those needs get started today learn how at cisco.com/go/cesa