In short: Cisco Secure Cloud Analytics, formerly Stealthwatch Cloud, was Cisco's SaaS network detection and response service. Cisco ended its standalone sale on 13 November 2023 and made its private network and public cloud monitoring part of Cisco XDR. Support continues through XDR, so existing users move to an XDR licence at renewal.
What Secure Cloud Analytics was
Secure Cloud Analytics started life as Stealthwatch Cloud, the cloud-delivered sister of Stealthwatch Enterprise (now Cisco Secure Network Analytics). Instead of on-premises appliances, it ran as a SaaS service and modelled the behaviour of every entity it could see. It had two monitoring modes:
- Private Network Monitoring (PNM): lightweight sensors on your network sent NetFlow, IPFIX and packet-derived metadata to the cloud for analysis
- Public Cloud Monitoring (PCM): native flow logs and API data from AWS, Microsoft Azure and Google Cloud were analysed without agents
It produced alerts for things like unusual remote access, port scanning, new internal connections, possible data exfiltration and risky cloud configuration changes, and it integrated with Meraki MX for network telemetry.
What changed in 2023
| Milestone | Detail (per Cisco) |
|---|---|
| End-of-sale announced | 11 August 2023 |
| Last day to order or renew standalone | 13 November 2023 |
| Support | Not ended: it continues through Cisco XDR |
| Where the capability lives now | Network detection and response built into every Cisco XDR edition |
| Replacement products named by Cisco | Cisco XDR Essentials and Cisco XDR Advantage |
In short, Cisco did not retire the technology. It folded it into Cisco XDR so that network detections sit alongside endpoint, email, identity and firewall detections in one incident view.
How Cisco XDR delivers the same detections now
- The same analytics engine: XDR's built-in NDR uses the behavioural modelling and alert library that powered Secure Cloud Analytics
- Private network monitoring: on-premises sensors and flow exports still feed the analytics, now presented inside XDR
- Public cloud monitoring: AWS, Azure and Google Cloud flow logs continue to be analysed for cloud workload and configuration threats
- Firewall logs: XDR can also analyse firewall log data for network detections
- Correlation: network alerts are joined with detections from Secure Endpoint, Secure Email Threat Defense and other sources into a single incident
- Response: you can act from the incident, for example isolating a host through Secure Endpoint or blocking a destination at the firewall or Secure Access
What existing users should do
- Check your contract: find your current Secure Cloud Analytics term end date and whether you already hold an XDR entitlement
- Map to an XDR edition: Cisco lists Essentials and Advantage as the replacements; choose Essentials if your other security tools are mostly Cisco, Advantage if you need third-party EDR or email integrations, or Premier if you want Cisco to run it as a managed service
- Keep sensors and cloud integrations: plan with us whether existing sensors and flow-log integrations carry over or need re-registration in the XDR tenant
- Review alerts and integrations: carry over tuned alert settings, watchlists and Meraki MX integration, noting Cisco requires the Meraki MX Advantage licence for XDR's MX integration
- Train the team on working incidents in XDR rather than alerts in the old console
See Cisco XDR licensing for the editions, or consider the Breach Protection Suite if you also need endpoint and email protection.
Secure Cloud Analytics or Secure Network Analytics?
The two names are easy to confuse:
| Secure Cloud Analytics (now in XDR) | Secure Network Analytics | |
|---|---|---|
| Former name | Stealthwatch Cloud | Stealthwatch Enterprise |
| Delivery | SaaS, inside Cisco XDR | Your own hardware or virtual appliances |
| Data | Flow data, firewall logs and public cloud flow logs | NetFlow, IPFIX and Flow Sensor data at high scale |
| Buy today as | Part of Cisco XDR | Standalone or in Breach Protection Advantage |
| Best for | Lean teams, hybrid and cloud estates | Large on-premises networks, data that must stay on site |
For more on the on-premises product, see Cisco Secure Network Analytics.
How we help
We review your existing Secure Cloud Analytics or Stealthwatch Cloud deployment, recommend the right XDR edition, align the renewal with your other Cisco subscriptions and move sensors, cloud integrations and alert tuning across without losing visibility. Ask us for a quote. Contact us using the form. Our Cisco security end-of-life guide covers other renamed products.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco Secure Cloud Analytics end of life?
Its standalone sale ended on 13 November 2023, but Cisco did not end support. The capability became part of Cisco XDR, and support continues through XDR.
Is Stealthwatch Cloud the same as Secure Cloud Analytics?
Yes. Stealthwatch Cloud was renamed Cisco Secure Cloud Analytics, which is now delivered as the network detection built into Cisco XDR.
Can I still buy Secure Cloud Analytics?
Not as a standalone product. You get the same network and public cloud detection by licensing Cisco XDR, on its own or within the Breach Protection Suite.
What replaced Secure Cloud Analytics?
Cisco lists Cisco XDR Essentials and Cisco XDR Advantage as the replacements. If you would rather Cisco ran detection and response for you, Cisco XDR Premier delivers XDR as a managed service.