<\/a><\/p>\n<\/p>\n\nFacing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted channels, increasing the need to inspect encrypted traffic traversing the network to look for possible obscured threats.<\/p>\nIn Cisco Secure Firewall version 10.0,\u00a0our most recent software release,\u00a0we\u2019ve\u00a0delivered four compelling new features to help customers quickly and efficiently assess and act on information in their network traffic.\u00a0You can\u00a0test drive these capabilities today with\u00a0Secure Firewall Test Drive,\u00a0an\u00a0instructor led\u00a0course that will guide you through the Secure Firewall and its powerful roles in cybersecurity for your organization.<\/p>\nSimplified\u00a0decryption<\/h2>\nThe best way to gain visibility into encrypted traffic is to decrypt it. The new simplified decryption experience in Cisco Secure Firewall version 10.0 simplifies the steps\u00a0required\u00a0to enable and manage encryption. Instead of a traditional rules-based design, Easy Decrypt allows fast creation of inbound and outbound decryption policies by targeting internal servers via any type of network object.<\/p>\n\n<\/noscript><\/figure>\n<\/div>\n\n<\/noscript><\/figure>\n<\/div>\nAdditionally, certificates are individually selectable for each server. The public-facing certificates can be serviced by\u00a0LetsEncrypt, significantly reducing certificate maintenance overheads. Outbound decryption certificate management can now be managed right from the decryption policy page, making for an easier workflow when building out policies.<\/p>\nAll object types supported for decryption policies include key attributes such as\u00a0fully qualified domain\u00a0name\u00a0(FQDN), URL, network and network groups and ranges, source group tags, dynamic objects, and more.<\/p>\nTo ease selective decryption as needed, the Cisco-provided\u00a0AppID\u00a0bypass list allows excluding entries from this list for decryption.\u00a0The\u00a0previous\u00a0release of\u00a0Cisco Secure\u00a0Firewall\u00a0introduced\u00a0Intelligent Decryption Bypass, further easing decision making around which traffic to decrypt by assessing low-risk traffic that is\u00a0likely safe\u00a0to bypass decryption processes. It\u00a0determines\u00a0what traffic is\u00a0low\u00a0risk\u00a0by combining data from\u00a0Talos reputation scores\u00a0and the client threat confidence score presented by the\u00a0Encrypted Visibility Engine (EVE).<\/p>\nLastly, all new rules are automatically enabled for comprehensive logging to provide better visibility into rules\u2019 usage and any potential considerations within the network.<\/p>\nQUIC\u00a0decryption<\/h2>\nQuick UDP Internet Connections\u00a0(QUIC)\u00a0is a natively encrypted secure protocol designed to increase the flexibility and performance of web applications while also bolstering security. However, it is also more difficult to gain visibility into this traffic, as the transport technology is different from traditional\u00a0TCP-encrypted traffic. QUIC instead relies upon\u00a0User Datagram Protocol (UDP)\u00a0transport and\u00a0directly implements\u00a0TLS 1.3 into the session handshake, allowing encryption of handshake messages after the first packet. Whereas TCP+TLS\u00a0encryption\u00a0left handshake messages transparent to inspection,\u00a0almost all\u00a0handshake data after the first packet is hidden with QUIC. Even the Server Name Indicator (SNI),\u00a0which specifies the server the client is communicating with,\u00a0can be encrypted by implementing Encrypted Client Hello (ECH) alongside QUIC.<\/p>\nSeveral obfuscations within QUIC make it difficult to trace or follow a full QUIC session, such as:<\/p>\n\nSequence numbering in the header is encrypted<\/li>\nNo TCP metadata exists, such as for\u00a0SYN, ACK, FIN, RST messages<\/li>\nMultiplexed streams are hidden inside the encryption<\/li>\nThe connection can be migrated across IP addresses without transport header\u00a0indication<\/li>\n<\/ul>\nThe express purpose of QUIC is to leave only the essential information a router or similar device requires to\u00a0transmit\u00a0and\u00a0forward\u00a0packets, but this goal runs contrary to the security and\u00a0accountability\u00a0goals of many organizations.<\/p>\nQUIC adoption is on the rise among global web traffic, increasing from about 7% usage in 2020 to around 45% usage in 2025. About a third of all web services and over 80% of Google services are now QUIC-first (that is, services where QUIC is offered before TCP+TLS).<\/p>\n\n<\/noscript><\/figure>\n<\/div>\nConsidering this rising adoption and the need for greater visibility and control where the QUIC protocol is in use, decryption policies in Cisco Secure Firewall version 10.0 have been enhanced to allow decryption and inspection upon QUIC traffic to ensure visibility is\u00a0maintained\u00a0while taking advantage of the improvements offered by this protocol.<\/p>\nIn environments and use cases where decryption of QUIC traffic\u00a0isn\u2019t\u00a0possible, the Encrypted Visibility Engine (EVE) provides highly\u00a0accurate\u00a0fingerprinting of QUIC traffic that uniquely characterizes and analyzes\u00a0QUIC-encrypted sessions to assess post-exploit beaconing and similar suspicious traffic. This compelling capability\u00a0helps\u00a0ensure that all organizations can gain insight and protections for QUIC traffic as the usage of this protocol increases.<\/p>\nShadow\u00a0traffic reporting<\/h2>\nSome techniques offered by privacy technologies cause a loss of visibility within organizational networks. This collection of new\u00a0\u201cLoss of Visibility\u201d\u00a0reports focuses on these\u00a0cases, offering statistical and detailed reports to help\u00a0identify\u00a0traffic where security analysis is incomplete due to obfuscations between the source and destination.<\/p>\n\n<\/noscript><\/figure>\n<\/div>\nIncluded\u00a0\u201cLoss of Visibility\u201d\u00a0reports<\/h2>\nMultihop\u00a0proxies:<\/strong>\u00a0Traffic passing from a client to a proxy that in turn passes to one or more proxies becomes difficult to trace to origin and may\u00a0indicate\u00a0an attempt to hide attack attempts.<\/p>\nEncrypted DNS:\u00a0<\/strong>If domain name lookup information is not available, then policies restricting certain domain names do not take effect as expected.<\/p>\nFake TLS:<\/strong>\u00a0Some traffic\u00a0contains\u00a0TLS handshakes, headers, or other implementations that\u00a0indicate\u00a0TLS encryption is employed while not actually conforming to the protocol, instead providing a route for malware attacks,\u00a0command\u00a0and control beaconing, or tunneling non-encrypted traffic.<\/p>\nEvasive VPN:<\/strong>\u00a0Some VPN services intentionally conceal signals\u00a0indicating\u00a0their use through means such as traffic masking or obfuscating the protocols used for the traffic. When evasive VPNs are detected, the application making the evasive connections is\u00a0identified\u00a0in the Shadow Traffic view, allowing for simple policy creation to block that process.<\/p>\nDomain\u00a0fronting:<\/strong>\u00a0Some connections will advertise widely trusted front domains in the SNI, then use a different HTTP host header inside the encrypted connection to direct traffic to a different backend service on the same provider. This can cause rules\u00a0that\u00a0allow widely trusted domains to have unintended side effects, allowing traffic that is not desirable. These domain-fronting URLs are displayed in the Shadow Traffic view to highlight where policy decisions may need to be made.<\/p>\nAdditionally,\u00a0it\u2019s\u00a0now easier to\u00a0modify\u00a0configurations to disallow these technologies where desired.<\/p>\nAdvanced\u00a0logging<\/h2>\nTo enhance the already robust set of information available for logged connections within Cisco Secure Firewall and Cisco Secure Network Analytics, a new log type has been created and made searchable. Characteristics logged include:<\/p>\nApplication\u00a0metadata:<\/strong>\u00a0Identify\u00a0suspicious applications or attempted misuses of known applications with exposure to the metadata\u00a0pertaining to\u00a0that application<\/p>\nIntelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted channels, increasing the need to inspect encrypted traffic traversing the network to look for possible obscured threats.<\/p>\n
In Cisco Secure Firewall version 10.0,\u00a0our most recent software release,\u00a0we\u2019ve\u00a0delivered four compelling new features to help customers quickly and efficiently assess and act on information in their network traffic.\u00a0You can\u00a0test drive these capabilities today with\u00a0Secure Firewall Test Drive,\u00a0an\u00a0instructor led\u00a0course that will guide you through the Secure Firewall and its powerful roles in cybersecurity for your organization.<\/p>\n
The best way to gain visibility into encrypted traffic is to decrypt it. The new simplified decryption experience in Cisco Secure Firewall version 10.0 simplifies the steps\u00a0required\u00a0to enable and manage encryption. Instead of a traditional rules-based design, Easy Decrypt allows fast creation of inbound and outbound decryption policies by targeting internal servers via any type of network object.<\/p>\n
Additionally, certificates are individually selectable for each server. The public-facing certificates can be serviced by\u00a0LetsEncrypt, significantly reducing certificate maintenance overheads. Outbound decryption certificate management can now be managed right from the decryption policy page, making for an easier workflow when building out policies.<\/p>\n
All object types supported for decryption policies include key attributes such as\u00a0fully qualified domain\u00a0name\u00a0(FQDN), URL, network and network groups and ranges, source group tags, dynamic objects, and more.<\/p>\n
To ease selective decryption as needed, the Cisco-provided\u00a0AppID\u00a0bypass list allows excluding entries from this list for decryption.\u00a0The\u00a0previous\u00a0release of\u00a0Cisco Secure\u00a0Firewall\u00a0introduced\u00a0Intelligent Decryption Bypass, further easing decision making around which traffic to decrypt by assessing low-risk traffic that is\u00a0likely safe\u00a0to bypass decryption processes. It\u00a0determines\u00a0what traffic is\u00a0low\u00a0risk\u00a0by combining data from\u00a0Talos reputation scores\u00a0and the client threat confidence score presented by the\u00a0Encrypted Visibility Engine (EVE).<\/p>\n
Lastly, all new rules are automatically enabled for comprehensive logging to provide better visibility into rules\u2019 usage and any potential considerations within the network.<\/p>\n
Quick UDP Internet Connections\u00a0(QUIC)\u00a0is a natively encrypted secure protocol designed to increase the flexibility and performance of web applications while also bolstering security. However, it is also more difficult to gain visibility into this traffic, as the transport technology is different from traditional\u00a0TCP-encrypted traffic. QUIC instead relies upon\u00a0User Datagram Protocol (UDP)\u00a0transport and\u00a0directly implements\u00a0TLS 1.3 into the session handshake, allowing encryption of handshake messages after the first packet. Whereas TCP+TLS\u00a0encryption\u00a0left handshake messages transparent to inspection,\u00a0almost all\u00a0handshake data after the first packet is hidden with QUIC. Even the Server Name Indicator (SNI),\u00a0which specifies the server the client is communicating with,\u00a0can be encrypted by implementing Encrypted Client Hello (ECH) alongside QUIC.<\/p>\n
Several obfuscations within QUIC make it difficult to trace or follow a full QUIC session, such as:<\/p>\n
The express purpose of QUIC is to leave only the essential information a router or similar device requires to\u00a0transmit\u00a0and\u00a0forward\u00a0packets, but this goal runs contrary to the security and\u00a0accountability\u00a0goals of many organizations.<\/p>\n
QUIC adoption is on the rise among global web traffic, increasing from about 7% usage in 2020 to around 45% usage in 2025. About a third of all web services and over 80% of Google services are now QUIC-first (that is, services where QUIC is offered before TCP+TLS).<\/p>\n
Considering this rising adoption and the need for greater visibility and control where the QUIC protocol is in use, decryption policies in Cisco Secure Firewall version 10.0 have been enhanced to allow decryption and inspection upon QUIC traffic to ensure visibility is\u00a0maintained\u00a0while taking advantage of the improvements offered by this protocol.<\/p>\n
In environments and use cases where decryption of QUIC traffic\u00a0isn\u2019t\u00a0possible, the Encrypted Visibility Engine (EVE) provides highly\u00a0accurate\u00a0fingerprinting of QUIC traffic that uniquely characterizes and analyzes\u00a0QUIC-encrypted sessions to assess post-exploit beaconing and similar suspicious traffic. This compelling capability\u00a0helps\u00a0ensure that all organizations can gain insight and protections for QUIC traffic as the usage of this protocol increases.<\/p>\n
Some techniques offered by privacy technologies cause a loss of visibility within organizational networks. This collection of new\u00a0\u201cLoss of Visibility\u201d\u00a0reports focuses on these\u00a0cases, offering statistical and detailed reports to help\u00a0identify\u00a0traffic where security analysis is incomplete due to obfuscations between the source and destination.<\/p>\n
Multihop\u00a0proxies:<\/strong>\u00a0Traffic passing from a client to a proxy that in turn passes to one or more proxies becomes difficult to trace to origin and may\u00a0indicate\u00a0an attempt to hide attack attempts.<\/p>\nEncrypted DNS:\u00a0<\/strong>If domain name lookup information is not available, then policies restricting certain domain names do not take effect as expected.<\/p>\nFake TLS:<\/strong>\u00a0Some traffic\u00a0contains\u00a0TLS handshakes, headers, or other implementations that\u00a0indicate\u00a0TLS encryption is employed while not actually conforming to the protocol, instead providing a route for malware attacks,\u00a0command\u00a0and control beaconing, or tunneling non-encrypted traffic.<\/p>\nEvasive VPN:<\/strong>\u00a0Some VPN services intentionally conceal signals\u00a0indicating\u00a0their use through means such as traffic masking or obfuscating the protocols used for the traffic. When evasive VPNs are detected, the application making the evasive connections is\u00a0identified\u00a0in the Shadow Traffic view, allowing for simple policy creation to block that process.<\/p>\nDomain\u00a0fronting:<\/strong>\u00a0Some connections will advertise widely trusted front domains in the SNI, then use a different HTTP host header inside the encrypted connection to direct traffic to a different backend service on the same provider. This can cause rules\u00a0that\u00a0allow widely trusted domains to have unintended side effects, allowing traffic that is not desirable. These domain-fronting URLs are displayed in the Shadow Traffic view to highlight where policy decisions may need to be made.<\/p>\nAdditionally,\u00a0it\u2019s\u00a0now easier to\u00a0modify\u00a0configurations to disallow these technologies where desired.<\/p>\nAdvanced\u00a0logging<\/h2>\nTo enhance the already robust set of information available for logged connections within Cisco Secure Firewall and Cisco Secure Network Analytics, a new log type has been created and made searchable. Characteristics logged include:<\/p>\nApplication\u00a0metadata:<\/strong>\u00a0Identify\u00a0suspicious applications or attempted misuses of known applications with exposure to the metadata\u00a0pertaining to\u00a0that application<\/p>\nIntelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Encrypted DNS:\u00a0<\/strong>If domain name lookup information is not available, then policies restricting certain domain names do not take effect as expected.<\/p>\nFake TLS:<\/strong>\u00a0Some traffic\u00a0contains\u00a0TLS handshakes, headers, or other implementations that\u00a0indicate\u00a0TLS encryption is employed while not actually conforming to the protocol, instead providing a route for malware attacks,\u00a0command\u00a0and control beaconing, or tunneling non-encrypted traffic.<\/p>\nEvasive VPN:<\/strong>\u00a0Some VPN services intentionally conceal signals\u00a0indicating\u00a0their use through means such as traffic masking or obfuscating the protocols used for the traffic. When evasive VPNs are detected, the application making the evasive connections is\u00a0identified\u00a0in the Shadow Traffic view, allowing for simple policy creation to block that process.<\/p>\nDomain\u00a0fronting:<\/strong>\u00a0Some connections will advertise widely trusted front domains in the SNI, then use a different HTTP host header inside the encrypted connection to direct traffic to a different backend service on the same provider. This can cause rules\u00a0that\u00a0allow widely trusted domains to have unintended side effects, allowing traffic that is not desirable. These domain-fronting URLs are displayed in the Shadow Traffic view to highlight where policy decisions may need to be made.<\/p>\nAdditionally,\u00a0it\u2019s\u00a0now easier to\u00a0modify\u00a0configurations to disallow these technologies where desired.<\/p>\nAdvanced\u00a0logging<\/h2>\nTo enhance the already robust set of information available for logged connections within Cisco Secure Firewall and Cisco Secure Network Analytics, a new log type has been created and made searchable. Characteristics logged include:<\/p>\nApplication\u00a0metadata:<\/strong>\u00a0Identify\u00a0suspicious applications or attempted misuses of known applications with exposure to the metadata\u00a0pertaining to\u00a0that application<\/p>\nIntelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Fake TLS:<\/strong>\u00a0Some traffic\u00a0contains\u00a0TLS handshakes, headers, or other implementations that\u00a0indicate\u00a0TLS encryption is employed while not actually conforming to the protocol, instead providing a route for malware attacks,\u00a0command\u00a0and control beaconing, or tunneling non-encrypted traffic.<\/p>\nEvasive VPN:<\/strong>\u00a0Some VPN services intentionally conceal signals\u00a0indicating\u00a0their use through means such as traffic masking or obfuscating the protocols used for the traffic. When evasive VPNs are detected, the application making the evasive connections is\u00a0identified\u00a0in the Shadow Traffic view, allowing for simple policy creation to block that process.<\/p>\nDomain\u00a0fronting:<\/strong>\u00a0Some connections will advertise widely trusted front domains in the SNI, then use a different HTTP host header inside the encrypted connection to direct traffic to a different backend service on the same provider. This can cause rules\u00a0that\u00a0allow widely trusted domains to have unintended side effects, allowing traffic that is not desirable. These domain-fronting URLs are displayed in the Shadow Traffic view to highlight where policy decisions may need to be made.<\/p>\nAdditionally,\u00a0it\u2019s\u00a0now easier to\u00a0modify\u00a0configurations to disallow these technologies where desired.<\/p>\nAdvanced\u00a0logging<\/h2>\nTo enhance the already robust set of information available for logged connections within Cisco Secure Firewall and Cisco Secure Network Analytics, a new log type has been created and made searchable. Characteristics logged include:<\/p>\nApplication\u00a0metadata:<\/strong>\u00a0Identify\u00a0suspicious applications or attempted misuses of known applications with exposure to the metadata\u00a0pertaining to\u00a0that application<\/p>\nIntelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Evasive VPN:<\/strong>\u00a0Some VPN services intentionally conceal signals\u00a0indicating\u00a0their use through means such as traffic masking or obfuscating the protocols used for the traffic. When evasive VPNs are detected, the application making the evasive connections is\u00a0identified\u00a0in the Shadow Traffic view, allowing for simple policy creation to block that process.<\/p>\nDomain\u00a0fronting:<\/strong>\u00a0Some connections will advertise widely trusted front domains in the SNI, then use a different HTTP host header inside the encrypted connection to direct traffic to a different backend service on the same provider. This can cause rules\u00a0that\u00a0allow widely trusted domains to have unintended side effects, allowing traffic that is not desirable. These domain-fronting URLs are displayed in the Shadow Traffic view to highlight where policy decisions may need to be made.<\/p>\nAdditionally,\u00a0it\u2019s\u00a0now easier to\u00a0modify\u00a0configurations to disallow these technologies where desired.<\/p>\nAdvanced\u00a0logging<\/h2>\nTo enhance the already robust set of information available for logged connections within Cisco Secure Firewall and Cisco Secure Network Analytics, a new log type has been created and made searchable. Characteristics logged include:<\/p>\nApplication\u00a0metadata:<\/strong>\u00a0Identify\u00a0suspicious applications or attempted misuses of known applications with exposure to the metadata\u00a0pertaining to\u00a0that application<\/p>\nIntelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Domain\u00a0fronting:<\/strong>\u00a0Some connections will advertise widely trusted front domains in the SNI, then use a different HTTP host header inside the encrypted connection to direct traffic to a different backend service on the same provider. This can cause rules\u00a0that\u00a0allow widely trusted domains to have unintended side effects, allowing traffic that is not desirable. These domain-fronting URLs are displayed in the Shadow Traffic view to highlight where policy decisions may need to be made.<\/p>\nAdditionally,\u00a0it\u2019s\u00a0now easier to\u00a0modify\u00a0configurations to disallow these technologies where desired.<\/p>\nAdvanced\u00a0logging<\/h2>\nTo enhance the already robust set of information available for logged connections within Cisco Secure Firewall and Cisco Secure Network Analytics, a new log type has been created and made searchable. Characteristics logged include:<\/p>\nApplication\u00a0metadata:<\/strong>\u00a0Identify\u00a0suspicious applications or attempted misuses of known applications with exposure to the metadata\u00a0pertaining to\u00a0that application<\/p>\nIntelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Additionally,\u00a0it\u2019s\u00a0now easier to\u00a0modify\u00a0configurations to disallow these technologies where desired.<\/p>\n
To enhance the already robust set of information available for logged connections within Cisco Secure Firewall and Cisco Secure Network Analytics, a new log type has been created and made searchable. Characteristics logged include:<\/p>\n
Application\u00a0metadata:<\/strong>\u00a0Identify\u00a0suspicious applications or attempted misuses of known applications with exposure to the metadata\u00a0pertaining to\u00a0that application<\/p>\nIntelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Intelligent PCAPs:\u00a0<\/strong>Detailed packet data to\u00a0facilitate\u00a0deep forensics of security events<\/p>\nDeeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Deeper insights on layer 5-7 connections:\u00a0<\/strong>This focus on more detailed information about session, presentation, and application layer traffic provides more comprehensive visibility into\u00a0application-level\u00a0activities to investigate breaches even where network level traffic looks benign or trusted<\/p>\nHTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
HTTP, FTP, DNS, and\u00a0connection logging:\u00a0<\/strong>By detailing web, file transfer, domain lookup, and general connection data, greater context is available for closer investigations of security events<\/p>\nWeird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Weird\u00a0logging:<\/strong>\u00a0Capturing protocol deviations and unusual network behaviors alert security teams to traffic that may signal novel attacks or misconfigurations within applications and networks<\/p>\nNotice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Notice\u00a0logging:<\/strong>\u00a0Specifically,\u00a0security-relevant events are grouped and surfaced to aid in threat hunting and analysis<\/p>\nThis enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\nSplunk\u00a0correlation\u00a0with\u00a0advanced logging<\/h2>\nThe deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\nTake a\u00a0hands-on look\u00a0at Cisco Secure Firewall 10.0<\/h2>\nWant to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n\nWe\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
This enhanced data helps network and security administrators understand more about the traffic in their organization\u2019s network and make informed policy decisions and recommendations.<\/p>\n
The deeper insights in\u00a0advanced logging\u00a0allow for Splunk correlations to existing Cisco Secure Firewall logs and events, as well as other network and security logs and data within organizational environments and\u00a0monitored\u00a0by the organization\u2019s Splunk instance. These correlations offer opportunities to\u00a0more quickly detect, triage, and create responses to security events by streamlining efforts to trace the event through the network and find additional signals to understand the event\u2019s impact.<\/p>\n
Want to dive deeper into Cisco firewalls? Sign up for the\u202fCisco Secure Firewall Test Drive, an instructor-led,\u00a04-hour hands-on course where\u00a0you\u2019ll\u00a0experience the Cisco\u00a0firewall\u00a0technology in action and learn about the latest security challenges and attacker techniques.<\/p>\n
We\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\nCisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Cisco Security Social Media<\/mark><\/strong><\/p>\nLinkedIn<\/p>\n<\/p><\/div>\n<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
LinkedIn<\/p>\n<\/p><\/div>\n
<\/a><\/p><\/p>\n","protected":false},"excerpt":{"rendered":"Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Facing an\u00a0ever-evolving\u00a0and increasingly sophisticated cybersecurity landscape, organizations have a pressing need to gain greater\u00a0visibility of\u00a0and insights into their network traffic.\u00a0Most threats are delivered over encrypted […]<\/p>\n","protected":false},"author":1,"featured_media":16697,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16696"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16696\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16697"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Summary](\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2026\/02\/shadowtraffic-1024x686.webp\")
![\"Retail](\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png\")
![\"New](\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2026\/01\/decryption-on-off-1024x422.webp\")
![\"Inbound](\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2026\/01\/decryption-details-1024x317.webp\")
![\"\"](\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2026\/01\/quic-adoption.webp\")