Administration

Use the Administration left navigation menu in Cisco XDR to view your account information, configure integrations, devices, and API clients, manage existing users in your Cisco XDR organization, invite users to your organization, and manage and customize incident playbooks.

Note: Only users with an Administrator role has access to Playbooks, Integrations, On-Premises Appliances, Detection Settings, and API Clients pages.

Cisco XDR My Account page with user details, organization, licensing, roles, and date/time format settings.

Use the My Account menu to view your Cisco XDR account information and format the date and time used throughout the Cisco XDR UI.

See My Account for more information.

Use the Notifications menu to manage the notifications sent to you if an incident or approval task is assigned to you by another user or if an Automation workflow or rule is temporarily disabled.

See Notifications for more information.

Use the Playbooks menu to manage and customize incident response playbooks and rules used to assign them to incidents. This page displays all the custom playbooks and assignment rules that have been created for your organization.

See Playbooks for more information.

Use the Integrations menu to manage the product integrations within your organization in Cisco XDR. This page displays all the available Cisco and third-party integrations and a list of your existing integrations.

See Integrations for more information.

For a device to be integrated with Cisco XDR, it must first be added and then registered in Security Services Exchange so that the devices can write to the storage in Security Services Exchange and then from there to Cisco XDR. Use the On-Premises Appliances menu to view and manage the devices that are configured in Cisco Security Services Exchange.

See On-Premises Appliances for more information.

Use the Detection settings menu to view and configure the detections available for Cisco XDR native telemetry. These detections are used to generate security events, and allow you to validate the data that is ingested byCisco XDR for incident correlation.

See Detection Settings for more information.

Cisco XDR is built upon a collection of APIs that can be used to integrate your Cisco and third-party security products, automate the incident response process, and manage threat intelligence and security context data in a single location. Once configured, API clients allow you to integrate and automate Cisco XDR by calling the collection of APIs it is built upon. For programs or tools that are API clients, you must create an API client in Cisco XDR so it can be assigned privileges specific to its task.

Use the API Clients menu to view and manage the API clients that are integrated with Cisco XDR.

See API Clients for more information.

Use the Users menu to manage the users in your Cisco XDR organization. From this page, you can enable and disable the Allow Non-Admin Users feature, view the user’s email address and name, and manage their role and status. You can also invite users to join your Cisco XDR organization and manage invitations.

See Users for more information.