Integrations

The authorship type badge on the integration card, on the integration details page, and in the My Integrations panel indicates who created the integration.

• Cisco Managed - Authored by Cisco and supported by Cisco Support.

• Cisco Verified - Authored by a Cisco Security Technology Partner and supported by that partner.

The following table lists the IP addresses you must allow for Cisco XDR to access your product APIs:

Prerequisite: If your product is an on-premises device, it must be registered in Security Services Exchange before adding the integration. See On-Premises Appliances.

1. Choose Administration > Integrations in the navigation menu.

   You can filter the integrations that are displayed on the page based on capability. For details, see Filter Integrations. You can also search for integrations that are displayed on the page based on integration name and description. See Search Integrations for more information.

2. On the Integrations page, click the Cisco tab to view a list of Cisco integrations or the Third-Party tab to view a list of the third-party integrations.

3. Navigate to the integration you want to configure and click Get Started, Enable, or + in the integration card.

   

   Note: If you click Enable, the configuration and activation of the integration is completed within the integrating product. Once enabled, it is automatically integrated in Cisco XDR and the integration is displayed under My Integrations. You do not need to complete the remaining steps.

4. Complete the form in the Add Integration area. For details on how to set up your integration, expand the Integration Guide panel by clicking the (Expand) icon and follow the instructions in the Integrations Guide panel.

   

5. Click Add to add the integration.

   A health check is performed to determine if the integration was properly configured. Once the health check is completed, the status is displayed in the upper right corner indicating that either there were no issues with the configuration (Connected) or that errors were found (Error). If errors occurred, correct the configuration and click Add.

   The integration is displayed in the My Integrations panel and the Status column shows whether it is Connected or if there is an Error with the configuration.

On the Integrations page, click the Capabilities or Authorship Type drop-down list and check the check boxes next to the capability or authorship type to filter the integrations that are displayed on the page.

The integrations that match your selections are displayed in the My Integrations panel, the Cisco tab, and the Third-Party tab. For more information on the capabilities, see Cisco and Third-Party Integrations and Supported Capabilities and for details on the authorship types, see Authorship Types.

Enter the search criteria in the Search text box on the Integrations page to search for integrations by the integration name and description. The integrations that match your search criteria are displayed in the My Integrations panel, the Cisco tab, and the Third-Party tab.

All integrations configured for your environment are shown in the My Integrations panel on the Integrations page. The total number of configuration errors found with all your integrations is displayed next to My Integrations and you can view the error messages by clicking the error badge.

Click the (Expand) icon to display all the configured integrations. The Status column indicates whether the module is Connected (successfully configured) or if it has an Error with the configuration. Click the error badge to view the error details.

The Authorship Type column indicates who created the integration. For details, see Authorship Types.

Update Integrations

All integrations configured for your environment are shown in the My Integrations drop-down area. The Status column whether the integration is Connected (successfully configured) or if it has an Error with the configuration. If it has errors, you can edit the integration:

1. Choose Administration > Integrations in the navigation menu and expand the My Integrations panel.

2. In the Integration Name column, click the row of the integration you want to edit. The Edit Integration area displays the current integration settings.

3. Edit the settings as needed, and click Save.

   A health check is performed to determine if the integration was properly configured. A message is displayed in the upper portion of the page, indicating that the health check is running. Once it completes, a message displays indicating that either there were no issues with the configuration or that errors were found.

Delete an Integration

1. Choose Administration > Integrations in the navigation menu and expand the My Integrations panel.

2. In the Integration Name column, click the row of the integration you want to delete. The Edit Integration area displays the current integration settings.

3. Click Delete.

4. On the confirmation dialog, click Delete.

   The integration is removed and its data is no longer available.

By default, the following integrations are automatically integrated with Cisco XDR:

• Cisco File Reputation - Cisco File Reputation is the database that powers Cisco file hash lookups. It stores billions of file hashes and associated dispositions, sourced from Cisco Talos, Cisco Secure Malware Analytics, and other trusted providers. By default, Cisco XDR comes configured to connect to Cisco File Reputation.
• Cisco XDR Global Threat Intelligence - The Cisco XDR Global Threat Intelligence is a repository of Cisco and third-party intelligence curated by Cisco. By default, Cisco XDR comes configured to connect to Cisco XDR Global Threat Intelligence.
• Private Intelligence - Private Intelligence is a data storage facility built into Cisco XDR to store the incidents that display in Cisco XDR Incidents list, casebooks, snapshots, and user-provided data used in investigations, such as the user’s own threat intelligence or internal observations by other security tools. By default, Cisco XDR comes configured to connect to Private Intelligence.
• Talos Intelligence - Talos is Cisco’s industry-leading threat intelligence team that protects your organization’s people, data and infrastructure from active adversaries. The Talos team collects information about existing and developing threats, and provides comprehensive protection against more attacks and malware than anyone else. All Cisco Security products utilize Talos threat intelligence, providing fast and effective security solutions. Their job is protecting your network.