Beginner’s Guide to
ThousandEyes
Primož Kolman
Global Solutions Engineer
BRKENT-1656
Cisco Webex App
Questions?
Use Cisco Webex App to chat
with the speaker after the session
How
1
Find this session in the Cisco Live Mobile App
2
Click “Join the Discussion”
3
Install the Webex App or go directly to the Webex space
4
Enter messages/questions in the Webex space
Enter your personal notes here
Webex spaces will be moderated by the speaker until June 13, 2025.
© 2025 Cisco and/or its affiliates. All rights reserved.
-
BRKCOM-2019
2
Introduction
Primož Kolman
Global Solutions Engineer
Cisco ThousandEyes
•
Software development and computer
networks background
•
Joined ThousandEyes in 2015
•
Various customer-facing roles
•
Cisco Certified Specialist - Enterprise
Network Assurance
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
3
Agenda
© 2025 Cisco and/or its affiliates. All rights reserved.
01
Introduction
02
Application Providers
03
Enterprise Networks
04
Remote Workforce
05
We Want More
06
Licensing
07
Start Today
BRKENT-1656
4
Join at slido.com
#3562841
The Slido app must be installed on every computer you’re presenting
from
BRKENT-1656
5
What is your responsibility
The Slido app must be installed on every computer you’re presenting
from
BRKENT-1656
6
Introduction
What were you doing,
when … ?
Demo
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
8
Why do you need ThousandEyes?
IF
YOU
CAN
READ
Y O U
D
T
© 2025 Cisco and/or its affiliates. All rights reserved.
h
O
THIS,
P R O B A B L Y
o
N
u
’
s
T
a
n
N
d
E
E
BRKENT-1656
y
E
e
D
s
9
Why do you need ThousandEyes?
Houston, we
have a problem
Employee
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
10
Full-bleed photo, title placeholder
It’s not your fault, but it is your problem
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
11
Problem Landscape: Application Provider
Is it my CDN
Provider?
Chicago, US
San Francisco,
US
Is it my DNS
Provider?
Is it my
Infrastructure?
Tokyo, JP
Sao Paulo, BR
c
London, UK
Is it my ISP?
Which Customers
are affected?
Customer / User
© 2025 Cisco and/or its affiliates. All rights reserved.
Is it my App?
Internet
BRKENT-1656
Website / Application
12
Problem Landscape: Branch Office
CISCO SASE
Is it the
transit ISP?
CISCO SECURE ACCESS
Is it the ISP?
Secure web
gateway
L7
firewall
Cloud access
security broker
(CASB)
Adaptive MFA Device posture
and health
Behavior
analytics
Continuous
verification
DNS security
Internet
IPSec tunnel
SD-WAN router
Is it the
SECaaS?
SD-WAN
SSO
SaaS
Branch office
Is it the
enterprise
LAN?
Is it SaaS?
SD-WAN mesh
Is it SD-WAN
underlay?
Analytics /
automation
Middle-mile
efficiency
Telemetry
SaaS
Integrated multioptimization
cloud access
Application
SLA
On-prem apps
Is it the
Application?
Is it SD-WAN
overlay?
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
13
Problem Landscape: Remote Worker
Is it the
transit ISP?
Is it the ISP?
CISCO SECURE ACCESS
Internet
Is it the
WiFi?
DNS
security
Public / private apps
Secure web
gateway
Cloud access
security broker
(CASB)
Secure TLS
SSO
DNS / HTTP / HTTPS
Secure Client
Remote worker
Is it the home
network?
Adaptive
MFA
Device posture
and health
Behavior
analytics
Clientless
remote access
Is it the SaaS?
Network gateway
Web apps / SSH
Optional
Remote access
All ports / protocols
Problem is between
user and keyboard
© 2025 Cisco and/or its affiliates. All rights reserved.
Public cloud /
SaaS
On-prem apps
Gateway
Is it
SECaaS?
Internet
BRKENT-1656
Is it the VPN
Gateway?
Is it the
Application?
14
ThousandEyes Dashboard
Service
availability
Application
availability
Per-office
performance
Per-office
availability
SSE
performance
Application
performance
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
15
decreases your
mean-time-to-resolution &
mean-time-to-innocence
ThousandEyes
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
Cisco Digital Resilience
Assurance
Observability
Security
Can our employees use
business-critical apps?
Is it the network or the
app?
Which network is causing
the issue?
Can our customers use Turn technical metrics
into a high-level
our app?
system state overview
Is it the app server,
and business metrics.
database, network,
cloud, …?
Comprehensive threat
prevention, detection,
investigation, and
response.
NetOps
© 2025 Cisco and/or its affiliates. All rights reserved.
AppOps
ITOps
BRKENT-1656
SecOps
17
Cisco Digital Resilience
Assurance
Observability
Security
Can our employees use
business-critical apps?
Is it the network or the
app?
Which network is causing
the issue?
Can our customers use Turn technical metrics
into a high-level
our app?
system state overview
Is it the app server,
and business metrics.
database, network,
cloud, …?
Comprehensive threat
prevention, detection,
investigation, and
response.
NetOps
Meraki
Catalyst
AppOps
ThousandEyes
ITOps
Splunk
O11y
SecOps
Splunk Cloud / Enterprise
ITSI
AppD
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
18
ThousandEyes Use-cases
Application Provider
You are an online service provider
(retail, bank, SaaS, …)
Your customers are everywhere.
You monitor your applications and
APIs.
© 2025 Cisco and/or its affiliates. All rights reserved.
Enterprise Network
Remote Workforce
You own your network
infrastructure, but also rely on
Cloud, SD-WAN and SSE.
Your workers rely on businesscritical applications while working
from anywhere.
You monitor the network between
your campus, branch offices, DCs
and multi-cloud.
You monitor the applications your
employees use, on-prem or in the
cloud.
BRKENT-1656
19
How Do We Do It?
We passively gather data
from network devices
(Device Layer, Traffic
Insights)
Application
LAN
Worker
Internet
We passively gather data
from the client
(Endpoint Agent)
© 2025 Cisco and/or its affiliates. All rights reserved.
We generate our own
synthetic traffic
(Cloud, Enterprise and
Endpoint Agent)
BRKENT-1656
We passively gather data
from Cloud providers
(Cloud Insights)
No packet captures
20
ThousandEyes Agents
Cloud Agents
Enterprise Agents
Endpoint Agents
Installed in 270 cities and 69
countries around the world:
• Broadband ISPs,
• Cloud providers (AWS, Azure,
GCP, Alibaba),
• Webex DCs.
Install them in your offices:
• on Cisco devices, as VMs,
Docker containers, Intel NUC
appliances.
Perform active application and
network performance monitoring.
Install them on your employees’
computers (Windows & macOS).
Perform active application and
network tests.
Passively collect performance data
(WiFi metrics, CPU, …).
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
21
Application Providers
Demo
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
23
Cloud Path Enrichment and Topology Visualization
• Deep visibility into public cloud
infrastructure and service
dependencies.
• Provide additional details when
traffic traverses cloud service
provider networks.
• Auto discover cloud provider
resources to understand every
service dependency.
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
25
Cloud Inventory
• Enables Ops teams to quickly
identify and report on
configuration and operational
changes that impact user
experience.
• Automatically creates an
inventory of all elements and
services across the entire cloud
infrastructure.
• Consolidated inventory reporting
across all AWS/Azure accounts,
regions, VPCs, etc.
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
26
Cloud Traffic Views
• Ingests VPC flow logs and
displays traffic information in prebuilt dashboards and views.
• Traffic views can be filtered by
several dimensions.
• Cloud account, region,
availability zone, VPC,
application
• Events takes recent configuration
changes and other events.
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
27
Enterprise Networks
Demo
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
29
Enterprise Agent
• Install it in your office in user VLAN
• Cisco Catalyst and Meraki devices
• VM, Docker, Intel NUC, Raspberry Pi
• Install on whatever available, Cisco devices give you no visibility advantage
• Performs active application and network performance tests
• Performs complex Web application testing (incl. SSO)
• Can test VPN and SD-WAN underlay (requires router policies)
• Provides constant baseline even without active users
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
30
Enterprise Agent Deployment Matrix
Platform
Web Browser Tests
Multi-interface
Virtual Appliance
Yes
Yes
Docker
Yes
Yes
Linux package (Ubuntu, RHEL)
Yes
Yes
Yes, with SSD
Yes
Cat 8200, Cat 8300, ISR 4000, ASR 1000, ISR 1000 X
No
No
Meraki MX
No
No
Nexus 9000
No
No
Physical Appliance on Intel NUC
Yes
Yes
Physical Appliance on Raspberry Pi
No
Yes
Cat 9300, Cat 9400
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
31
Traffic Insights
• Corelate NetFlow data with
synthetic tests for added context
that accelerates troubleshooting
efforts
• Vendor-agnostic - analyze data
from all your network
infrastructure to get a holistic
view of usage across your
environment
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
32
Demo
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
33
Device Layer
• Device layer provides visibility into performance of your internal network devices by gathering
network device topology
• Good old SNMP
• But still very useful to get that insight into Layer 2
• Free of charge
• A bridge between Cloud/Enterprise agent synthetics and Traffic Insights
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
34
Remote Workforce
Demo
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
36
Endpoint Agent
• Install it on your employees’ computers (Windows & macOS)
• Manual, Group policy or Managed Software Center
• Cisco Secure Client module or standalone installer
• Performs active application and network performance tests
• Passively collects performance data (WiFi metrics, CPU, …)
• Detects and monitors VPNs, proxies, ZTA
• Follows the employee wherever he works from
• Work from home
• Work from office
• Work from anywhere
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
37
Endpoint Agent & Cisco Secure Access
• Endpoint agent is an important component of Cisco Secure Access Experience Insights
• Comes for free with Cisco Secure Access, albeit not with full functionality (Experience
Insights license)
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
38
Mobile Endpoint Agent
• Announced this week. GA soon.
• Android >= 11
• Install through Play Store or MDM
• Subset of Endpoint Agent capabilities
• Adds mobile telemetry (RSRP, RSRQ, SINR, RSSI), battery level
• Zebra scanners
• Honeywell scanners, Chromebook, … soon
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
39
We Want More
ThousandEyes + Splunk
Test Recommendations
OpenTelemetry
Streaming Integration
OpenTelemetry
Streaming Integration
HEC Streaming
Integration
Splunk
Observability
Cloud
Technical
Add-on
Activity Log
© 2025 Cisco and/or its affiliates. All rights reserved.
Webhook Alert
Notifications
Splunk
AppDynamics
Splunk
Platform
BRKENT-1656
41
Internet Insights
• Internet insights provide network and SaaS app outage detection at Internet scale
• Visibility into network outages that disrupt your global SD-WAN mesh
• Visibility into SaaS application outages, and its scale and geographic scope
• Eliminates unnecessary troubleshooting cycles
• Used by organizations with global customer or employee presence
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
42
WAN Insights
• Applies statistical models to Catalyst Analytics path metrics
• Provides network forecasts and SD-WAN policy recommendations
• Optimizes user experience across enterprise sites
• If you have Catalyst Analytics, you’re already eligible to use it!
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
43
Connected Devices
• A suite of products and tests that gives you a
view into the 'last mile' of internet.
• Enhanced view of the home network,
including Wi-Fi and device performance.
• Helping ISPs and regulators deliver improved
performance.
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
44
Licensing
Licensing
Product
Licensing
Example
Cloud Agents
Enterprise Agents
Using Units, test usage based, linear
• 1 HTTP test 5-min interval on EA: 23 units / month
• 1 HTTP test 5-min interval on CA: 45 units / month
• 1 HTTP test 10-min interval on CA: 23 units /
month
Endpoint Agent
Agent based
• 500 active EPAs -> 500 EPA licences
• 3 license tiers
Cloud Insights
Cloud Insights Essentials or
Advantage
Flow based, using Units
• Adv for 1+ cloud provider and 50+ accounts
• 1000 flows / second -> 300 units / month
Traffic Insights
Flow based, using Units
• 1000 flows / second -> 250 units / month
Internet Insights
Per Region / Provider
• All ISPs in North America
• All CDNs in EMEA
• All in
Device Layer
Free
WAN Insights
Free with Catalyst SD-WAN Analytics
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
46
ThousandEyes Endpoint Agent Licenses
Advantage
Essentials
Experience Insights
Buying motion
Separate purchase
Separate purchase
Included in Secure Access
Data retention
30 days
14 days
4 days
Browser session
monitoring
Yes
Yes
No
Synthetic tests
10 dynamic and scheduled
tests (mix and match)
4 dynamic and scheduled
tests (mix and match)
1 dynamic test, 1 scheduled
test to SSE Cloud
infrastructure
Local network
tests
Included
Included
Included
Machine metrics
“Top 5”
“Top 5”
“Basic”
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
47
Start Today
© 2025 Cisco and/or its affiliates. All rights reserved.
Experience ThousandEyes
• Visit us in World of Solutions > Digital Resilience
• LABAPP-1100 Accelerate Network and Application Monitoring Visibility with ThousandEyes: Leveraging Dashboards,
Filters and Labels
• LABOBS-1003 AI-Driven Network Assurance Lab: Leveraging the Power of Cisco AI Assistant and ThousandEyes
• LABAPP-1003 Integrate and Monitor your public cloud with ThousandEyes cloud Insights
• LABCOL-1004 Implementing ThousandEyes for Collaboration in less than 60 minutes!
• LABAPP-1004 Deep Dive with ThousandEyes API monitoring test type and Integrations
• LABAPP-2000 Creating Custom ThousandEyes User Templates to Empower Network and Application Visibility
• LABOBS-2005 Next-Level Monitoring: ThousandEyes and OpenTelemetry in Action
• LABOBS-2006 ThousandEyes Traffic Insights: Enhancing Network Visibility Using ThousandEyes for NetFlow and
Synthetic Monitoring.
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
50
Complete your session evaluations
Complete a minimum of
4 session surveys and
the Overall Event
Survey to be entered in
a drawing to win 1 of 5
full conference passes
to Cisco Live 2026.
© 2025 Cisco and/or its affiliates. All rights reserved.
Earn 100 points per
survey completed
and compete on the
Cisco Live Challenge
leaderboard.
Level up and earn
exclusive prizes!
BRKENT-1656
Complete your surveys
in the Cisco Live
mobile app.
51
Continue your education
Visit the Cisco
Showcase for related
demos
Book your one-on-one
Meet the Engineer
meeting
Attend the interactive
education with DevNet,
Capture the Flag, and
Walk-in Labs
Visit the On-Demand
Library for more
sessions at
www.CiscoLive.com/
on-demand
Contact me at: primoz@cisco.com
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
52
decreases your
mean-time-to-resolution &
mean-time-to-innocence
ThousandEyes
© 2025 Cisco and/or its affiliates. All rights reserved.
BRKENT-1656
Thank you