Devices

Shows you at-a-glance the overall health and status of your sources of data that are integrated with Cisco XDR and enabled for the Devices feature.

If this percentage is less than 100, there may be a health concern with one or more sources. Click Asset Inventory Sources to open the Sources page and look for the pertinent error message to help you resolve the issue.

Displays pie graphs that show you the number of devices per device type (hover over the wedge segment) and how many are managed or unmanaged. Click a device type or status (or wedge segment) to list its devices in the inventory table.

Managed means it is a device in a device manager. Not restricted to only mobile devices, it works for all operating systems, as long as the device is managed by a device manager that you have linked in and that device manager reports that the device is being managed. Otherwise, if you remove the profile or app from a device, it will be marked as “Managed=No” in the device manager, and that gets reflected as Unmanaged in Cisco XDR.

Shows you the number of devices per operating system (OS). Click View all 13 Operating Systems to see all of the operating systems sorted by the number of devices from highest to lowest.

Use the Text Search box to filter the devices listed in the inventory table according to the text you enter.

Note: The search box is not case-sensitive when using Basic Search.

For example:

• Enter “demo” and Cisco XDR devices filters through all the device information, including device name, user names seen, and so on. If any of the device information contains the text you entered, that device will appear in the inventory table.
• Filter devices based on IP address. Enter a partial or complete IP address and the inventory table is updated in real-time as you type. Type 192.168 in the search box, and the inventory table will list all the devices that contain 192.168.
• Get more specific by adding a third octet such as 26, and only devices that contain 192.168.26 will appear in the inventory table.

Boolean Operators

You can also use the Boolean operators AND, OR, and NOT. They can make each search more precise and save you time.

For example:

• Enter “demo OR phone” in the search box and the table shows you devices that have the word “demo” in their data and devices that have the word “phone” in their data. Entering “demo phone” generates the same result.
• Enter “demo AND phone” in the search box and the table shows you devices that have both the words “demo” and “phone” somewhere in their data.
• Enter “NOT demo” in the search box and the table shows you devices that do not have the word “demo” in their information.

Another way to filter is to include the criteria in these search categories using the Filters drawer. Click Filters to open the drawer.

Each criteria shows the number (in parentheses) of devices in inventory that match that criteria.

These categories offer criteria that you can check to include them in your filter:

• Managed Status

  Managed means it’s a device managed by a device manager that you have linked and that device manager reports that the device is being managed. Otherwise, if the device is marked as “Managed=No” in the device manager, it gets reflected as Unmanaged in device inventory.

• Operating System

• OS Support

  Cisco XDR can tell you when your operating systems are out-of-date or end-of-life for most of your devices. However, server platforms are excluded from this feature. Cisco XDR leverages a special feed from Duo Security, which provides OS lifecycle information, and applies it to its non-server device inventory. This does not require a Duo integration with Cisco XDR.

• Type

  server, desktop, virtual, mobile

• Device Value

  You can select multiple device values and if the value is assigned by default, manually, or a rule.

• Has Faults
• AV Definitions out of date

These categories offer criteria that you can set to Must Include to include that criteria in your filter, or conversely Must Exclude:

• Labels
• Sources
• Policies

• Source Groups/Tags

  Source groups and tags are imported from integrations with Cisco XDR. Currently, we import groups from Secure Endpoint and tags from Cisco Meraki.

This category offers criteria where you select a start and end date to filter by the specified time range:

• Last Active

This category offers criteria where you enter a value to filter by:

• Minimum Cisco Security Risk Score

  Enter a value between 1 and 100. The table will be filtered to show devices with a Cisco Security Risk Score of the specified value and higher.

Checks Across Multiple Categories

A filter with checks across multiple categories results in a Boolean AND operation. For example, this filter results in the inventory table showing only the devices that meet all the specified conditions:

• Text Search

  have the text “desktop” somewhere in their information

• Managed Status

  is Unmanaged

• Operating System

  is running Windows

Checks Within a Category

Multiple checks within the same category results in a Boolean OR operation in that category. For example, this filter results in the inventory table showing all the unmanaged devices that are either running Windows or macOS:

• Managed Status

  is Unmanaged

• Operating System

  is running Windows

• Operating System

  is running macOS

These are just a few examples of how you can quickly search through your device inventory using the powerful filter to help you find what you’re looking for.

At any point, you can save the filter selection you’ve configured and pull it up to use again later, saving you the time of having to build it again. Click Add to saved filters to save it in your organization, and all users in the organization will be able to use that filter selection.

To conveniently use a saved filter again, select it from the Saved filters drop-down list. This added flexibility enables you to continue your search later and pick up where you left off. You can also modify a filter to save a new version of it and share a common filter for use across your organization.

To delete a saved filter, click the Saved filters drop-down list, then click the (Delete) icon. Click Delete to confirm.

You can scroll the list of devices using the scroll bar on the page or the up and down arrow keys on your keyboard. You can also edit the number of rows shown per page at the bottom of the table.

Note: If you have a large number of devices, selecting the last page of the table will cause a loading error to occur. Use filters to reduce the number of devices in the table to avoid the error.

Click the (Sort) icon next to the column headers to sort the table by that column in ascending or descending order.

To reorder the table columns, click and drag a column header to the desired position in the table.

Click the (Select columns) icon to open the Select columns drawer and check the check boxes next to the columns you want displayed in the table.

To create a label:

1. Click Edit Labels to open the drawer.

2. Click Add Label.

3. Enter a name and select a color for the new label.

4. Click the (Add) icon.
   The new label will be added to the drawer with a (New) tag.

5. Click Apply Changes to confirm all actions in the drawer.

Use the Search Labels text box at the top of the drawer to locate specific labels within the list. The labels that match your search are displayed in the drawer.

1. Click Edit Labels to open the drawer.

2. Click the (Ellipsis) icon to open the Options menu.

3. Choose Edit.

4. Update the label name or color.

5. Click Apply Changes to confirm all actions in the drawer.

To create a rule from search criteria:

1. Click Rules to open the drawer.

2. Click the Add Rule drop-down menu.

3. Choose Create Rule from Search. The Create Rule section opens with the criteria used in the Filters drawer.

4. Enter a name and description for the rule.

5. Edit the rule criteria if needed. For more information, see Filters.

6. Assign labels and a device value to apply to each device in the selected rule criteria.

7. Click Create.
   A success message is displayed, and the drawer refreshes with the rule added.

To create a rule from scratch:

1. Click Rules to open the drawer.

2. Click the Add Rule drop-down menu.

3. Choose Create Rule from Scratch. The Create Rule section opens.

4. Enter a name and description for the rule.

5. Add the rule criteria. For more information, see Filters.

6. Assign labels and a device value to apply to each device in the selected rule criteria.

7. Click Create.
   A success message is displayed, and the drawer refreshes with the rule added.

To edit existing rules:

1. Click Rules to open the drawer.

2. Click the (Ellipsis) icon to open the Options menu for the rule you want to edit.

3. Choose Edit.

4. Edit the rule.

5. Click Save when done.
   A success message is displayed, and the drawer refreshes.

To enable or disable a rule:

1. Click Rules to open the drawer.

2. Click the toggle for the rule you want to enable or disable.

3. Click Enable or Disable to confirm.
   A success message is displayed, and the drawer refreshes.

Note: Deleting rules is permanent and cannot be undone. All devices affected by the deleted rule will revert to their default rank and label.

To delete a rule:

1. Click Rules to open the drawer.

2. Click the (Ellipsis) icon to open the Options menu for the rule you want to delete.

3. Choose Delete.

4. Click Delete to confirm.
   A success message is displayed, and the drawer refreshes with the rule removed.

If you have a custom source or ServiceNow SecOps, you may have default rules defined by the system in the System Rules tab.

To edit a system rule:

1. Click Rules to open the drawer.

2. Click the System Rules tab.

3. Click the (Ellipsis) icon to open the Options menu for the rule you want to edit.

4. Choose Edit.

5. Edit the rule.

6. Click Save when done.
   A success message is displayed, and the drawer refreshes.

To update labels for one or more devices:

1. Check the check boxes next to the devices you want to update.

2. Click the Update Labels drop-down menu in the bulk action bar and choose the new labels.

3. Click Add.

To update labels for one or more devices:

1. Check the check boxes next to the devices you want to update.

2. Click the Update Labels drop-down menu in the bulk action bar and choose the labels you want to remove.

3. Click Remove.