Sensor Deployment Considerations

Placing Sensors on your Network

Sensor Deployment ConsiderationsYou can deploy sensors to collect flow data, or ingest network traffic that is mirrored from a network router or switch, or both. Depending on your network requirements, you can deploy some sensors within your environment to collect flow data, and other sensors within the same environment to ingest mirrored network traffic.NOTE: Sensors version 4.0 or greater can collect enhanced NetFlow telemetry. This allows Stealthwatch Cloud to generate new types of observations and alerts. For more information, see the Stealthwatch Cloud Configuration Guide for Enhanced NetFlow.Because network topologies vary greatly, keep the following general guidelines in mind when deploying your sensors:

Determine if you want to deploy sensors to:

collect flow data
ingest mirrored network traffic
have some collect flow data, and others ingest mirrored network traffic
both collect flow data and ingest mirrored network traffic

If collecting flow data, determine what formats you will collect, such as NetFlow v5, NetFlow v9, IPFIX, or sFlow.

NOTE: Many firewalls support NetFlow, including Cisco ASA firewalls and Cisco Meraki MX Appliances. Consult with your manufacturer's support documentation to determine if your firewall also supports NetFlow.

Deploy your sensors for switches or routers that will not exceed the sensor's Mirror port capacity.

Deploy as few sensors as possible, to reduce the need for maintenance.

Deploy sensors for switches or routers that serve as a network gateway between your internal network and the external internet, or between two internal network segments that you want to monitor.

Contact support@obsrvbl.com for help with deploying multiple sensors to your network.Checking Your Sensor VersionTo ensure you have the most recent sensor deployed on your network (version 4.0), you can check an existing sensor's version from the command line. If you need to upgrade, reinstall the sensor, as described in 6. Boot Media Creation – Physical Appliances Only and 7. Sensor Installation – Physical Appliances and Virtual Machines.

SSH log into the sensor.

At the prompt, enter cat /opt/obsrvbl-ona/version and press Enter. If the console does not display 4.0.0, your sensor is out of date. Download the most recent sensor ISO from the web portal UI, as described in 6. Boot Media Creation – Physical Appliances Only.