"One of the core features is that Vectra AI triages threats and correlates them with compromised host devices. From a visibility perspective, we can better track the threat across the network. Instead of us potentially finding one device that has been impacted without Vectra AI, it will give us the visibility of everywhere that threat went. Therefore, visibility has increased for us."
"Cognito Streams gives you a detailed view of what happens in the network in the form of rich metadata. It is just a super easy way to capture network traffic for important protocols, giving us an advantage. This is very helpful on a day-to-day basis."
"The dashboard gives me a scoring system that allows me to prioritize things that I should look at. I may not necessarily care so much about one event, whereas if I have a single botnet detection or a brute force attack, I really want to get on top of those."
"One of the most valuable features is all the correlation that it does using AI and machine learning. An example would be alerting on a host and then alerting on other things, like abnormal behavior, that it has noticed coming from the same host. It's valuable because we're a very lean team."
"The key feature for me for Detect for Office 365 is that it can also concentrate all the information and detection at one point, the same as the network solution does. This is the key feature for me because, while accessing data from Office 365 is possible using Microsoft interfaces, they are not really user-friendly and are quite confusing to use. But Detect for Office 365 is aggregating all the info, and it's only the interesting stuff."
"The administrative privilege detection feature is the most valuable feature. The admin accounts are often highly accessible to the high-risk component of the environment. If those accounts are compromised or are being used in a suspicious manner, that's high-fidelity events for us to look into."
"It has helped us to organize our security. We get a better overview on what is happening on the network, which has helped us get quicker responses to users. If we see malicious activity, then we can quickly take action on it. Previously, we weren't getting an overview as fast as we are now, so we can now provide a quicker response."
"It keeps up with the network traffic, which is a good thing. It provides more context to plain alerts compared to using an older system. So, it helps an analyst reduce the information overload."
"It's easy to set up. The deployment takes one or two days. You need to collect the data from a device and then direct it to the portal."
"Overall, the implementation is very good."
"Great network monitoring, looking at anomaly detection and evaluation."
"It has definitely helped us improve our mean time to resolution on network issues."
"It provides good visibility to the customers. People are still evaluating it, but it provides visibility and helps them to take action to remediate and mitigate the issues that are highlighted on the dashboard. It has good integration with the Cisco switching platform."
"From what I understand, you can encrypt and unencrypt traffic moving in transit. This is one of the features that we liked about it."
"Cisco Stealthwatch has predefined alerts for different types of security issues that might happen in the network. Whether it's PCs or servers that are used for botnets or Bitcoin mining we receive the alerts automatically. This functionality is what we receive from the solution out of the box."
"We find that Stealthwatch can detect the unseen."
"When it comes to the ability to scale up the product, this is suitable for small medium and large environments,"
"I have found the AppResponse, which is a packet capture solution, very good. It gives you the ability to drill down back in time. You've got all the packets there. You can troubleshoot it later, not immediately. It's very interesting."
"We really like the scalability capabilities."
"The most valuable feature is performance monitoring."
"Integration with other security components needs improvement. It should have true integration as opposed to just being a separate pane of glass."
"Vectra is still limited to packet management. It's only monitoring packet exchanges. While it can see a lot of things, it can't see everything, depending on where it's deployed. It has its limits and that's why I still have my SIEM."
"It does a little bit of packet capture on alert so you can look at the packet capture activity going on, but it doesn't collect a whole lot of data. Sometimes it's only one or two frames, sometimes it does collect more. That's why they have the addition of their Recall platform, because that really does help expand the capability."
"If you hit a certain number of rules, triage filters, or groups, the UX responds more slowly. However, we have a complex network and a lot of rules. So, our setup might not be a typical implementation example. We even had UX engineers onsite, and they looked at issues, improvements, and user feedback. Since then, it has gotten a lot better, they even built in features that we specifically requested for our company."
"I would like more integrations with IOCs and threats currently on the Internet. I would also like to know which threats are based on zero-day attacks, current botnets, etc. Therefore, I would like more information on external threats."
"The false positives and the tuning side of it is something that could use improvement. But that could be from our side."
"The main improvement I can see would be to integrate with more external solutions."
"Some of their integrations with other sources of data, like external threat feeds, took a bit more work than I had hoped to get integrated."
"It's a good solid solution but integration with Network Access Control products with Cisco ISE would be good."
"We would like the solution to make more advances in the way that Extreme Networks has been doing."
"Cisco could improve the administration for the customers."
"The visualization could be improved, the GUI is not the best."
"We determined that Stealthwatch wouldn't provide the machine learning model that we required."
"Cisco Stealthwatch can improve by having bundled packages for popular add-ons. It would be a lot easier for people implementing it, have let's say a better way to use the product."
"Many of these tools require extensive on-premises hardware to run."
"Stealthwatch is still maturing in AI. It uses artificial intelligence for predictions, but AI still needs to mature. It is in a phase where you get 95% correct detection. As its AI engine learns more, it will become more accurate. This is applicable to all the devices that are using AI because they support both supervised and unsupervised machine learning. The accuracy in the case of supervised machine learning is dependent on the data you feed into the box. The accuracy in the case of unsupervised machine learning is dependent on the algorithm. The algorithm matures depending on retrospective learning, and this is how it is able to detect zero-day attacks."
"Technical support needs to be more responsive."
"The initial setup is straightforward, but you have to know a little about the product. It's not for everybody to just plug and play. If you know how the solution is implemented then it is straightforward."
"The AI features should be addressed in respect of the analysis and intelligence that must be supported and delivered in the tool to predigest the large amounts of data."
"The pricing is on the higher side of things. If they could lower it, that would be ideal."
Cisco Stealthwatch is ranked 4th in Network Traffic Analysis (NTA) with 8 reviews while Riverbed AppResponse is ranked 21st in Application Performance Management (APM) with 4 reviews. Cisco Stealthwatch is rated 8.2, while Riverbed AppResponse is rated 8.0. The top reviewer of Cisco Stealthwatch writes "Provides valuable security knowledge and helps us improve network performance". On the other hand, the top reviewer of Riverbed AppResponse writes "Has modules to troubleshoot web applications, database transactions, and unified communications, all in one". Cisco Stealthwatch is most compared with Darktrace, SolarWinds NetFlow Traffic Analyzer, ThousandEyes, Palo Alto Networks Threat Prevention and Cisco Stealthwatch Cloud, whereas Riverbed AppResponse is most compared with Dynatrace, AppDynamics, SolarWinds NPM, Wireshark and Zabbix.
We monitor all Network Traffic Analysis (NTA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
