Which StealthWatch device monitors, analyzes, separates, categorizes, and stores information from each flow, allowing it to create a baseline of typical expected network activity?

The Flow Collector receives NetFlow, IPFIX, sFlow, and other telemetry from routers, switches, and other network devices, then processes and stores each flow record. It continuously monitors this data to separate and categorize traffic by host, conversation, and behavior, building a statistical baseline of expected activity. This baseline is what enables the StealthWatch system to detect anomalies and potential threats through behavioral analysis.

Advanced Malware Protection is a separate Cisco product line focused on endpoint and file-based malware detection and is not a component of the StealthWatch (Secure Network Analytics) architecture.

Forensic investigation describes a use case or analytical workflow performed within StealthWatch, not the name of a specific StealthWatch device or appliance.

Malware clustering is an analytical algorithm or output within StealthWatch used to group suspicious hosts, not the name of a StealthWatch hardware or software component.