Cisco Secure Network Analytics (SNA) Playbook
This playbook is designed to provide you with use case education, customer requirements, and actions you'll need to take to help your customers navigate their Cisco product adoption.
You will be guided through the specific objectives of each stage of adoption and how they relate to the aligning automated digital experience.
As we learn more about what it takes for customers to be successful with their adoption, new resources and updated information can be added to this playbook, including if a customer becomes Stalled in Stage or requires additional troubleshooting aid.
Refer to the last page of this playbook for definitions, descriptions, and all associated resources to help your customer through their adoption.
How to coach for success with Cisco SNA
Help your customers get started with initial Cisco SNA onboarding steps, then learn how to tap into advanced features to further configure, customize, and secure their network.
To help your customer get started with Cisco SNA, guide them in accessing the dashboard and connecting their network data sources. Assist with initial configuration by adding a test device group and ensuring network traffic is visible. Help them prioritize integration with critical network segments, and configure alerting policies for effective threat detection. Finally, ensure that your customer reviews activity logs to confirm monitoring and ensure their network environment is secure.
Refer to the last page of this playbook for definitions, descriptions, and all associated resources to help your customer through their adoption.
Customers enter the journey when they meet the following corresponding entry criteria:
Customer has an active email address
Legacy SWATCH Appliance Physical - FlowCollector
Cisco SWATCH Appliance Virtual - Flow Collector
Cisco SWATCH Appliance Physical - FlowCollector
Legacy SWATCH Appliance Physical - FlowCollector
Cisco SWATCH Appliance Virtual - Flow Collector
Cisco SWATCH Appliance Physical - FlowCollector
Legacy SWATCH License - Management Console
Legacy SWATCH Appliance Physical - Management Console
Cisco SWATCH Appliance Virtual - Management Console
Cisco SWATCH Appliance Physical - Management Console
Legacy SWATCH Appliance Physical - Management Console
Cisco SWATCH Appliance Virtual - Management Console
Cisco SWATCH Appliance Physical - Management Console
Cisco SWATCH Cloud License
Cisco SWATCH license - FlowRate
DNA Premiere - DNA4C1 - Subscription
Cisco SWATCH license - FlowRate
DNA Premiere - DNA4C1 - Subscription
Version 7.3+
Customers are eligible for the journey when they have purchased:
| Eligibility Rule | Hierarchy Component | Rule Description |
|---|---|---|
| Rule 1 | Subscription | Have at least one from (Cisco SWATCH License - FlowRate, DNA Premier-DNA4C1-Subscription) then eligible Note: Only PIDs LC-DNAC1-TRK-5Y, LC-DNAC1-TRK-3Y, LC-DNAC1-TRK-1Y are eligible under DNA Premier-DNA4C1-Subscription |
| Rule 2 | License | Have (Legacy SWATCH Lic - FPS) AND Management Console, Cisco SWATCH Appliance Virtual - Management Console, Cisco SWATCH Appliance Physical - Management Console) AND Any one of (Legacy SWATCH Lic - FlowCollector, Legacy SWATCH Appliance Physical – FlowCollector, Cisco SWATCH Appliance Virtual – FlowCollector, Cisco SWATCH Appliance Physical – FlowCollector) |
| Rule 3 | Minimum version | Version 7.3+ |
| Eligibility Scenarios |
|---|
| If Rule 1 is TRUE, then your customer is ELIGIBLE |
Refer to the last page of this playbook for definitions, descriptions, and all associated resources to help your customer through their adoption.
Guidance on helping your customer adopt Cisco SNA
In this stage, the customer will:
- Create a Cisco Smart Account and log into Cisco Software Central
- Open the Cisco Smart Software Manager (CSSM) and select a Virtual Account as needed based on their activity
- Generate a token to register and activate the license on their device, mixing and matching deployment options to fit their organization best
- Explore the benefits of Cisco SNA
- Attend a virtual event to get real-time answers from Cisco experts and see a step-by-step guided demo on how to activate their license(s)
The customer will exit this stage when they have:
Progressed to stage = Use
Activate
Subject Line: Activate Cisco Secure Network Analytics to begin your journey
Preheader: Gain full use of your investment by taking these actions today
Trigger: Customer receives this email when their stage = Onboard or Implement and they have not activated their Smart License
Goal: Promote creation of Cisco Smart Account and activation of Cisco Smart License
Preheader: Gain full use of your investment by taking these actions today
Trigger: Customer receives this email when their stage = Onboard or Implement and they have not activated their Smart License
Goal: Promote creation of Cisco Smart Account and activation of Cisco Smart License
Activate
In this stage, the customer will:
- Engage with experts via Cisco Professional Services for assistance in planning, designing, and implementing the Secure Network Analytics system
- View the Secure Network Analytics Guided Resource
- Explore the Security Analytics forum on Cisco Community
The customer will exit this stage when they have:
- Progressed to stage = Use
Welcome resources
Subject Line: Bookmark these Cisco Secure Network Analytics resources
Preheader: Everything you need for a successful deployment
Trigger: Customer receives this email when they enter the journey
Goal: Provide customers with resources needed to adopt the product
Preheader: Everything you need for a successful deployment
Trigger: Customer receives this email when they enter the journey
Goal: Provide customers with resources needed to adopt the product
Welcome resources
In this stage, the customer will:
- Install Secure Network Analytics System
- Gather data for creating Host Groups
- Configure telemetry sources to forward data to the Flow Collector(s) and ensure that all sources are visible as exporters in the Manager UI by verifying with the Flow Collection Status Report
The customer will exit this stage when they have:
- Progressed to stage = Use
Best practices
Subject Line: Tips for your Cisco Secure Network Analytics implementation
Preheader: Adopt these best practices
Trigger: Customer receives this email one week after the Welcome resources email is sent
Goal: Provide customers with implementation best practices
Preheader: Adopt these best practices
Trigger: Customer receives this email one week after the Welcome resources email is sent
Goal: Provide customers with implementation best practices
Best practices
In this stage, the customer will:
- Define inside and outside IP space
- Configure the Catch All Host Group
- Configure initial Host Groups
The customer will exit this stage when they have:
- Received all emails in the series
Core features
Subject Line: Ready to deploy Cisco Secure Network Analytics?
Preheader: Start with these Secure Network Analytics configurations
Trigger: Customer receives this email when there's a new contact one week after the Welcome resources email is sent or when existing contacts’ stage = Use, Engage, Adopt or Optimize
Goal: Highlight core product features and provide resources to learn more
Preheader: Start with these Secure Network Analytics configurations
Trigger: Customer receives this email when there's a new contact one week after the Welcome resources email is sent or when existing contacts’ stage = Use, Engage, Adopt or Optimize
Goal: Highlight core product features and provide resources to learn more
Core features
In this stage, the customer will:
- Establish a traffic baseline to detect any anomalies
- Run an initial report or flow search to become familiar with the security investigation process
- Analyze the report results to tailor policy settings to their environment on a weekly basis, continuously refining policy settings for optimal reporting
The customer will exit this stage when they have:
- Received all emails in the series
Feature focus
Subject Line: Tips for Cisco Secure Network Analytics deployment
Preheader: Plan and deploy with these best practices
Trigger: Customer receives this email two weeks after the Core features email is sent
Goal: Provide customers with steps to plan and deploy their policies
Preheader: Plan and deploy with these best practices
Trigger: Customer receives this email two weeks after the Core features email is sent
Goal: Provide customers with steps to plan and deploy their policies
Feature focus
In this stage, the customer will:
- Update Host Groups regularly and consider using Host Group Automation to reduce false positives and make investigations as efficient as possible
- Define custom security events
- Perform policy tuning regularly to ensure that alerts are the most actionable and high value
- Attend virtual events to watch live product demos
The customer will exit this stage when they have:
- Received all emails in the series
Top 3 recommendations
Subject Line: What you should know about successful Cisco Secure Network Analytics customers
Preheader: Use these top 3 best practices
Trigger: Customer receives this email two weeks after the Feature focus email is sent
Goal: Provide customers with best practices for using and tuning their policies
Preheader: Use these top 3 best practices
Trigger: Customer receives this email two weeks after the Feature focus email is sent
Goal: Provide customers with best practices for using and tuning their policies
Top 3 recommendations
In this stage, the customer will:
- Integrate with Cisco Splunk, Cisco XDR, and other SIEM tools as well as Cisco Secure Firewall logs and Cisco Secure Endpoint
- Include Advanced Host Group Automation via API integrations
- Integrate with Cisco ISE to add user context, automated Host Group updates, and TrustSec support
- Integrate Proxy Logs via Cisco Telemetry Broker
The customer will exit this stage when they have:
- Received all emails in the series
Advanced features
Subject Line: Advanced features for Cisco Secure Network Analytics
Preheader: Mature your Secure Network Analytics posture
Trigger: Customer receives this email four weeks after the Top 3 recommendations for success email is sent
Goal: Provide advanced features and integrations
Preheader: Mature your Secure Network Analytics posture
Trigger: Customer receives this email four weeks after the Top 3 recommendations for success email is sent
Goal: Provide advanced features and integrations
Advanced features
Refer to the last page of this playbook for definitions, descriptions, and all associated resources to help your customer through their adoption.
To further support your customers along their digital journey, you can provide them with key resources:
Refer to the last page of this playbook for definitions, descriptions, and all associated resources to help your customer through their adoption.