Resolving On-Premises Logging Gaps in Cisco Stealthwatch Cloud

350-701 By islever Editorial Last updated

Describe security monitoring and telemetry technologies

Short answer

B Deploy a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud.

Question

An organization has a Cisco Stealthwatch Cloud deployment in their environment. Cloud logging is working as expected, but logs are not being received from the
on-premise network. What action will resolve this issue?
  1. Deploy a Cisco FTD sensor to send events to Cisco Stealthwatch Cloud.
  2. Deploy a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud. Correct Answer
  3. Configure security appliances to send syslogs to Cisco Stealthwatch Cloud.
  4. Configure security appliances to send NetFlow to Cisco Stealthwatch Cloud.

Key Takeaways

It tests the understanding that while the cloud platform handles analysis, a local sensor is required to collect and forward data from isolated on-premise environments.

This question addresses the architecture of Cisco Stealthwatch Cloud for monitoring private networks, specifically how to ingest telemetry from on-premise sources that cannot reach the cloud directly.

Common mistake: Many candidates incorrectly choose Option D (NetFlow), assuming that appliances can send NetFlow directly to the cloud. In reality, direct NetFlow ingestion to the cloud console is not supported for on-premise sources; a local sensor must act as the collector.

Expert Analysis

Why the Answer Is Correct

The correct action is to deploy a Cisco Stealthwatch Cloud Sensor on the on-premise network (Option B). According to Cisco's architecture documentation, the Stealthwatch Cloud platform relies on a 'Cloud Sensor' appliance installed within the private network to collect flow data, syslog, and other telemetry from local security devices. This local sensor then securely forwards the aggregated data to the cloud instance for analysis.

Why the Other Options Are Wrong

Option A is incorrect because an FTD sensor is primarily used for firewall logs and does not inherently solve the collection gap for general network flows without specific configuration, whereas the dedicated Sensor is the standard component for this role. Option C is incorrect because security appliances generally do not send raw syslogs directly to the cloud console; they send them to the local sensor. Option D is the most common distractor; while NetFlow is the primary data type collected, it must be sent to the local Sensor first, not directly to the Cloud API/Console.

Community Comment Notes

The community consensus strongly favors Option B. As noted by user ic0deem and Stevens0103, Cisco's official whitepaper on Stealthwatch Cloud performance confirms that organizations deploying this solution for on-premise awareness require a deployed sensor appliance. User Dorr2737 further clarifies that netflows should be sent to the sensor, not directly to the cloud, reinforcing the architectural boundary.

Official Reference

https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf

This link opens the official vendor documentation in a new tab.

Exam Strategy

When studying Cisco Secure Network Analytics or Stealthwatch, distinguish between the Cloud Management plane and the Local Data Collection plane. Always identify if the source is 'on-premise'; if so, look for the 'Sensor' or 'Collector' option rather than direct cloud connectivity.

Frequently Asked Questions

Can security appliances send NetFlow directly to Stealthwatch Cloud?

No. On-premise appliances must send NetFlow to a locally deployed Stealthwatch Cloud Sensor, which then forwards it to the cloud.

What is the role of the Stealthwatch Cloud Sensor?

It acts as a local collector for flow, syslog, and event data from on-premise devices, bridging the private network to the cloud analytics engine.

More 350-701 FAQ →

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. ic0deem 👍 12
    B is correct. https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf
  2. Stevens0103 👍 4
    The answer is B. Check this out: https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf "Cisco Stealthwatch Cloud Private Network...is the perfect solution for organizations that want better awareness and security within their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying a lightweight appliance, referred to as the Stealthwatch Cloud Sensor, in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network."
  3. ums008 👍 3 Answered D
    I agree with some people who have already raised this concern, Correct Answer is D To resolve the issue of logs not being received from the on-premise network in a Cisco Stealthwatch Cloud deployment, the organization should configure their security appliances to send NetFlow data to Cisco Stealthwatch Cloud. NetFlow is a network protocol that provides visibility into network traffic flows. Option B, deploying a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud, is not the appropriate action to resolve this issue. Cisco Stealthwatch Cloud sensors are not deployed on the network itself but rely on data received from network devices, such as routers or switches, through protocols like NetFlow.
  4. Stevens0103 👍 3 Answered B
    https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf
  5. Edy79 👍 2
    I agree with B: Stealthwatch Cloud Sensor for Private Network Monitoring In order to monitor on-premises networks, a Stealthwatch Cloud Sensor appliance will need to be installed.
Show 9 more comments
  1. Dorr20 👍 2
    Logs from the Cloud are working. Logs from the On-Prem are not. Install a sensor on-prem to send the files. Netflows should be sent to the sensor, not directly to the cloud
  2. ddev3737_111 👍 2
    B is right
  3. ddev3737_111 👍 1
    I might be wrong, this is the info I have from the document= Stealthwatch Cloud Sensor for Private Network Monitoring In order to monitor on-premises networks, a Stealthwatch Cloud Sensor appliance will need to be installed. This appliance can be installed either as a physical appliance or as a virtual machine leveraging the ISO or OVF distributions. Conceptually, the figure below illustrates the deployment scenario of the Stealthwatch Cloud Sensor, where the on-premises sensor collects telemetry and forwards metadata to the customer’s Stealthwatch Cloud instance through an encrypted private tunnel.
  4. XBfoundX 👍 1 Answered B
    B is the correct one as many mentioned: . It is the perfect solution for organizations that want better awareness and security within their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying a lightweight appliance, referred to as the Stealthwatch Cloud Sensor, in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only.
  5. ddev3737_111 👍 1
    B could be incorrect because deploying a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud is not necessary. According to the scenario, the problem is that logs are not being received from the on-premise network, but adding a new sensor in the same network will not resolve the issue. The correct solution is to configure security appliances to send syslogs or NetFlow to Cisco Stealthwatch Cloud, which will allow logs to be received and analyzed.
  6. EMoshi 👍 1 Answered B
    true based on the link https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf
  7. 4pelos 👍 1
    Correct answer B. Checked in securitytut
  8. CyberGhost666 👍 1 Answered B
    B is correct
  9. kloug 👍 1
    Answer b

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide