Cisco Secure Cloud Analytics (Stealthwatch) by Axity

Axity believes that visibility is critical because you cannot secure what you cannot see. The proposed Secure Cloud Analytics offers actionable intelligence and comprehensive visibility into cloud resources, so that our clients can identify malicious activities in real time and respond before a security incident becomes a devastating breach. Secure Cloud Analytics delivers effective security measures for public cloud workloads, while reducing the number of false positives.

Secure Cloud Analytics is an AWS Native Security Visibility Service, provides security monitoring and visualization services for AWS infrastructure using advanced modeling and machine learning techniques. Our service learns normal behavior for a resource or a user. When a behavior change is observed that should be investigated, Stealthwatch Cloud will generate an alert with various details.

The service consumes VPC flow logs and models all IP traffic generated by your resources, both inside the VPC and to external IP addresses. New Remote Access, Geographic Unusual Remote Access, Excessive Access Attempts and Potential Database Exfiltration are examples of Stealthwatch Cloud alerts. In addition, network reports like top IPs, top ports, active subnets with traffic statistics, etc, are available.

The service is also integrated with additional AWS log sources like Cloud Trail, Cloud Watch, Config, Inspector, IAM, Lambda, etc. Abnormal User, Geographically Unusual AWS API Usage, Permissive AWS Security Group activity, and Inspector Findings are examples of alerts produced from these other AWS sources.

The monthly fee is based on the amount of VPC Flow Log information that is sent and processed.