Cisco Telemetry Broker

Name: Cisco Telemetry Broker
Brand: Cisco

Cisco Telemetry Broker is a telemetry pipeline product that routes, replicates, filters, and transforms telemetry streams between producers and consumers, enabling one-to-many forwarding and protocol translation (for example, AWS VPC Flow Logs to IPFIX) so multiple tools can consume the same data without reconfiguring each exporter.

Website

Published Oct 15, 2026

01Common complaints

Consider alternatives or simpler approaches when: 1. Only basic NetFlow/IPFIX forwarding to a single collector is required — built-in exporter features or lightweight collectors may suffice. 2. Packet-level network visibility (taps, packet slicing, advanced packet broker features) is the main requirement — visibility fabric vendors provide broader packet-level capabilities. 3. Extensive third-party validation and many public reviews are an important procurement criterion — CTB has limited public review coverage in accessible sources. 4. The organization prefers a DIY telemetry engineering approach (Kafka/Telegraf/custom collectors) and is prepared for a higher engineering burden to avoid vendor licensing. 5. The organization is sensitive to perceived vendor-driven upsell practices; community commentary includes concerns that CTB may be positioned as an additional licensed product in some contexts.

Deal disqualifiers (poor fit)

Very small environments with a single consumer of flow data.
Organizations unwilling or unable to operate an appliance/cluster and associated licensing.
Organizations that require packet-level visibility fabric capabilities rather than flow telemetry.

Limitations evidenced or strongly suggested by sources

Limited third-party review coverage located during research, which makes independent verification of vendor claims more difficult.
Commercial opacity: pricing is largely quote-based; Cisco documents the consumption licensing model but does not publish clear tier pricing publicly.
Operational overhead: certificate rotation and other management tasks can require manual broker node updates after manager identity certificate changes.

Roadmap / future features

No CTB roadmap with dates was found in publicly accessible sources in this research run.

02Why they buy

Key differentiators supported by evidence

Hybrid cloud flow log translation: CTB is commonly cited for translating AWS VPC Flow Logs to IPFIX, enabling on‑prem flow tools to consume cloud telemetry without retooling collectors.
Central brokering, filtering, and transformation: CTB provides centralized routing and transformation of flow telemetry for multiple consumers.

Competitor advantages

Competitors may have broader market presence, more public review coverage, and more extensive packet-level visibility features.

03Field reports

Review platform coverage (G2 / TrustRadius / Gartner Peer Insights)

A CTB product page or set of reviews was not found on mainstream review platforms in accessible sources during this research.
This is a limitation: CTB appears less frequently reviewed on mainstream SaaS review platforms than more user-facing software.

Community / practitioner feedback (selected excerpts)

Because formal review pages were not found, community discussions provide directional practitioner inputs. These may over-represent specific incidents or viewpoints. Positive / neutral signals (use-case validation): - CTB is referenced as the replacement product for UDP Director in some Cisco contexts. - CTB has been used in proofs of concept for flow replication and cloud flow log conversion (for example, converting VPC flow logs to netflow/IPFIX to feed on‑prem collectors). Critical / skeptical sentiment (commercial/packaging concerns): - Some community comments reflect a perception that CTB may be positioned as an additional licensed product, creating concerns about whether the purchase is driven by technical need or licensing strategy. Adjacent telemetry pain points (implementation complexity): - Separate community threads indicate that streaming telemetry can be configuration‑sensitive and that some open‑source monitoring tools do not support Cisco streaming telemetry natively; these are broader telemetry program issues rather than CTB‑specific defects.

Why customers choose CTB (inferred from evidence)

Based on vendor material and community mentions, organizations select CTB when they require:

One‑to‑many flow replication without duplicating exporters.
Cloud flow log translation (AWS VPC Flow Logs → IPFIX) to feed on‑prem collectors/tools.
Integration within Cisco Secure Network Analytics architectures that expect or benefit from a telemetry aggregator/broker.

Why some customers avoid or leave (directional)

Directional reasons observed in community commentary include:

Perception that CTB is a licensed add‑on rather than a purely technical requirement.
General Cisco licensing/support complexity and recurring support costs, which affect the procurement experience.

What was found

Public, Cisco Telemetry Broker (CTB)-specific case studies with independently verified return-on-investment metrics were scarce in the reviewed material. Cisco publishes architecture and deployment guides and presents CTB in conference sessions, but independent third-party case study evidence with quantifiable business outcomes was not identified in this research set.

Vendor-provided example (not independently verified)

Cisco materials describe CTB enabling visibility in hybrid environments by translating cloud flow logs (e.g., VPC flow logs from major cloud providers) to IPFIX for on-premises tools. This describes a concrete technical capability but is not accompanied by quantified business outcomes (for example, measured detection improvement or mean time to resolution reduction) in the reviewed content.

04Best fit

Company size

Typical fit: mid-market to large enterprise that operate multiple security/observability tools requiring shared telemetry feeds and that need hybrid cloud visibility.

Industries / verticals

Cisco positions CTB in general enterprise and security contexts; some Cisco collateral references use cases in regulated industries such as healthcare for telemetry normalization and distribution.

Roles and personas

Decision makers: Director/VP of Security Operations, Network/Security Architecture.
End users: security engineers, network telemetry/visibility engineers, NDR/SIEM platform owners.

Best-fit pain points

Multiple tools require the same flow data and reconfiguring exporters is operationally costly.
Cloud flow logs are not compatible with existing on‑prem collectors and need normalization/translation.
A central point to manage telemetry routing reduces repeated exporter changes.

05The pitch

What the product does (objective value proposition)

Cisco Telemetry Broker (CTB) is a telemetry pipeline product that sits between telemetry producers (network devices, cloud flow logs, sensors) and telemetry consumers (security analytics, NDR/XDR, SIEM, observability tools). Its core functions are to route/replicate, filter, and transform telemetry streams so multiple tools can consume the same data without reconfiguring every exporter for every destination. Commonly cited capabilities include: - Brokering/replication: one-to-many forwarding of telemetry feeds to multiple consumers. - Filtering: dropping/allowing subsets of traffic/records per destination (fine-grained control). - Transformation: protocol/format translation (for example, AWS VPC Flow Logs → IPFIX for on‑prem collectors/tools).

Target market and market positioning

- Primary buyers/users: security operations, network/security engineering teams, and enterprises running flow-based visibility (NetFlow/IPFIX) across hybrid environments. - Positioning: a telemetry plane component that reduces duplication of telemetry configuration, allows reuse of existing collectors, and assists hybrid-cloud telemetry (notably cloud flow logs) to integrate into traditional on‑prem flow analytics. CTB is frequently discussed as a replacement for Cisco Secure Network Analytics / Stealthwatch UDP Director in Cisco-centric flow analytics architectures.

Get a comprehensive analysis of Cisco Telemetry Broker including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 15, 2026

01Common complaints

Consider alternatives or simpler approaches when:

Only basic NetFlow/IPFIX forwarding to a single collector is required — built-in exporter features or lightweight collectors may suffice.
Packet-level network visibility (taps, packet slicing, advanced packet broker features) is the main requirement — visibility fabric vendors provide broader packet-level capabilities.
Extensive third-party validation and many public reviews are an important procurement criterion — CTB has limited public review coverage in accessible sources.
The organization prefers a DIY telemetry engineering approach (Kafka/Telegraf/custom collectors) and is prepared for a higher engineering burden to avoid vendor licensing.
The organization is sensitive to perceived vendor-driven upsell practices; community commentary includes concerns that CTB may be positioned as an additional licensed product in some contexts.

Deal disqualifiers (poor fit)

Very small environments with a single consumer of flow data.
Organizations unwilling or unable to operate an appliance/cluster and associated licensing.
Organizations that require packet-level visibility fabric capabilities rather than flow telemetry.

Limitations evidenced or strongly suggested by sources

Limited third-party review coverage located during research, which makes independent verification of vendor claims more difficult.
Commercial opacity: pricing is largely quote-based; Cisco documents the consumption licensing model but does not publish clear tier pricing publicly.
Operational overhead: certificate rotation and other management tasks can require manual broker node updates after manager identity certificate changes.

Roadmap / future features

No CTB roadmap with dates was found in publicly accessible sources in this research run.

02Why they buy

Key differentiators supported by evidence

Hybrid cloud flow log translation: CTB is commonly cited for translating AWS VPC Flow Logs to IPFIX, enabling on‑prem flow tools to consume cloud telemetry without retooling collectors.
Central brokering, filtering, and transformation: CTB provides centralized routing and transformation of flow telemetry for multiple consumers.

Competitor advantages

Competitors may have broader market presence, more public review coverage, and more extensive packet-level visibility features.

03Field reports

Review platform coverage (G2 / TrustRadius / Gartner Peer Insights)

A CTB product page or set of reviews was not found on mainstream review platforms in accessible sources during this research.
This is a limitation: CTB appears less frequently reviewed on mainstream SaaS review platforms than more user-facing software.

Community / practitioner feedback (selected excerpts)

Because formal review pages were not found, community discussions provide directional practitioner inputs. These may over-represent specific incidents or viewpoints.

Positive / neutral signals (use-case validation):

CTB is referenced as the replacement product for UDP Director in some Cisco contexts.
CTB has been used in proofs of concept for flow replication and cloud flow log conversion (for example, converting VPC flow logs to netflow/IPFIX to feed on‑prem collectors).

Critical / skeptical sentiment (commercial/packaging concerns):

Some community comments reflect a perception that CTB may be positioned as an additional licensed product, creating concerns about whether the purchase is driven by technical need or licensing strategy.

Adjacent telemetry pain points (implementation complexity):

Separate community threads indicate that streaming telemetry can be configuration‑sensitive and that some open‑source monitoring tools do not support Cisco streaming telemetry natively; these are broader telemetry program issues rather than CTB‑specific defects.

Why customers choose CTB (inferred from evidence)

Based on vendor material and community mentions, organizations select CTB when they require:

One‑to‑many flow replication without duplicating exporters.
Cloud flow log translation (AWS VPC Flow Logs → IPFIX) to feed on‑prem collectors/tools.
Integration within Cisco Secure Network Analytics architectures that expect or benefit from a telemetry aggregator/broker.

Why some customers avoid or leave (directional)

Directional reasons observed in community commentary include:

Perception that CTB is a licensed add‑on rather than a purely technical requirement.
General Cisco licensing/support complexity and recurring support costs, which affect the procurement experience.

What was found

Vendor-provided example (not independently verified)

Cisco materials describe CTB enabling visibility in hybrid environments by translating cloud flow logs (e.g., VPC flow logs from major cloud providers) to IPFIX for on-premises tools. This describes a concrete technical capability but is not accompanied by quantified business outcomes (for example, measured detection improvement or mean time to resolution reduction) in the reviewed content.

04Best fit

Company size

Typical fit: mid-market to large enterprise that operate multiple security/observability tools requiring shared telemetry feeds and that need hybrid cloud visibility.

Industries / verticals

Cisco positions CTB in general enterprise and security contexts; some Cisco collateral references use cases in regulated industries such as healthcare for telemetry normalization and distribution.

Roles and personas

Decision makers: Director/VP of Security Operations, Network/Security Architecture.
End users: security engineers, network telemetry/visibility engineers, NDR/SIEM platform owners.

Best-fit pain points

Multiple tools require the same flow data and reconfiguring exporters is operationally costly.
Cloud flow logs are not compatible with existing on‑prem collectors and need normalization/translation.
A central point to manage telemetry routing reduces repeated exporter changes.

05The pitch

What the product does (objective value proposition)

Commonly cited capabilities include:

Brokering/replication: one-to-many forwarding of telemetry feeds to multiple consumers.
Filtering: dropping/allowing subsets of traffic/records per destination (fine-grained control).
Transformation: protocol/format translation (for example, AWS VPC Flow Logs → IPFIX for on‑prem collectors/tools).

Target market and market positioning

Primary buyers/users: security operations, network/security engineering teams, and enterprises running flow-based visibility (NetFlow/IPFIX) across hybrid environments.
Positioning: a telemetry plane component that reduces duplication of telemetry configuration, allows reuse of existing collectors, and assists hybrid-cloud telemetry (notably cloud flow logs) to integrate into traditional on‑prem flow analytics.

CTB is frequently discussed as a replacement for Cisco Secure Network Analytics / Stealthwatch UDP Director in Cisco-centric flow analytics architectures.

Get a comprehensive analysis of Cisco Telemetry Broker including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →