Stealthwatch: from NetFlow records to alarms and quarantine
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
Stealthwatch (today Cisco Secure Network Analytics) doesn't inspect packets: it collects the flow records that routers, switches and firewalls export anyway (NetFlow, IPFIX, sFlow, NSEL), de-duplicates them and stitches them into conversations, then learns what's normal for every host and group. When a host deviates — it scans, beacons to a command server, collects or takes data out above its baseline — the algorithms emit Security Events, the indices rise and, above the threshold, an alarm appears in one of the 11 categories. Through pxGrid, ISE puts the user on every flow and can isolate the host with a CoA; Encrypted Traffic Analytics judges encrypted traffic by the first packet and the rhythm of the packets, without decryption. Most deployments fail because of simple things: default timers, an incomplete Inside Hosts, UDP 2055 blocked, no NTP.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms, products and standards. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of the security control room of a mall with hundreds of inside doors: at every door there's a log of who went through, from where, to where, how long they stayed and how many bags they carried — nobody opens the bags. The control room gathers the logs, learns what every employee does on a normal day and turns on a light when someone tries every door on the floor or takes out ten boxes at two in the morning.
The model holds up to §9. At §10 (ETA) and §11 (cloud) it stretches, and on the sizing details it breaks; see the full analogy and its limits in §15.