Configure Ribbon Settings

To configure the Cisco XDR ribbon, casebook, and notification settings, click the (Settings) icon on the ribbon menu or Settings on the ribbon Home page.

XDR Ribbon settings: Automatic theme, button control, draggable enabled, bottom-right location, and reset defaults.

On the Settings page, click My Account in the left navigation menu to view your account profile which includes your user name, account email address, role, organization, and IDP used to log in.

On the Settings page, click XDR Ribbon in the left navigation menu to configure your ribbon settings.

Click one of the following options to specify the background color of the ribbon:

  • Light - Displays a light background (default).

  • Dusk - Displays a dark background.

  • Automatic - Displays the background to automatically match the theme of the integrated product.

    When Automatic theme is selected, you can also choose to automatically set it to the Inverse of the product theme or Match the product theme.

  • Control Format - Click Button or Bar to specify the ribbon format when it is collapsed.

    • Button - Displays the Open XDR Ribbon floating button when the ribbon is collapsed (default). If enabled, the following settings are available to manage the behavior of the Cisco XDR Ribbon icon in a collapsed view:

      • Draggable - Check the check box to allow the ability to drag and drop the Open XDR Ribbon floating button anywhere in the UI.

      • Location - Click the location you want to lock the Open XDR Ribbon floating button in the UI. Uncheck the Draggable check box to keep the location of the floating button locked. To unlock the location of the button, check the Draggable check box.

      • Offset - Drag the slider to set the offset value of the Open XDR Ribbon floating button from the edge of the browser window. This is applicable for draggable and locked floating button positions.

      • Hover Delay - Drag the slider to set the delay, in seconds, when you hover over the Open XDR Ribbon floating button.

      • Open Button - Click the toggle to enable a dedicated Open XDR Ribbon icon when you hover over the Open XDR Ribbon floating button. If enabled, click the Open XDR Ribbon icon when you hover over the Open XDR Ribbon floating button to expand the ribbon view, instead of clicking the Open XDR Ribbon floating button. The toggle is disabled (Off) by default.

      • Sync Location - Click All to synchronize the location of the Open XDR Ribbon floating button with all the products in all the browser tabs. Click Local to synchronize the location of the Open XDR Ribbon floating button with all the browser tabs with the same domain address only.

    • Bar - Displays the ribbon bar when the ribbon is collapsed. Click Full or Reduced to set the size of the ribbon when it is collapsed. Depending on the integration, this feature may be disabled.

Storage - Click Clear Storage to clear the stored settings and state for the ribbon and all the ribbon applications. This will not delete any data objects such as cases and incidents.

Authorization - Click Revoke to reauthorize ribbon to resolve any authentication issues. This is only applicable if the ribbon requires authorization.

Scopes - Click View Scopes to display a list of required, functional, and optional scopes for ribbon in a View Scopes popup.

View Scopes dialog displaying required application permissions for Casebook, data access, and user settings.

  • A red warning icon is displayed next to Scopes on the Settings page if you are missing any required scopes and a yellow warning icon is displayed if you are missing any functional or optional scopes. Click View Scopes to display details of any missing scopes and click Reauthorize to reauthorize ribbon to resolve the missing scopes.

    Note: This is only applicable if the ribbon requires authorization.

Version - The release version number of the ribbon.

Reset - Click Reset to Defaults to reset all settings for the Cisco XDR ribbon to its default values.

On the Settings page, click Casebook in the left navigation pane to configure casebook app settings.

  • Auto Open - Check the check box to automatically open a newly created case in the casebook. The check box is checked by default. Uncheck the check box if you do not want a new case to open by default in the casebook.

    If you want to always swap to the Casebook app when creating a new case, check the check box. The check box is checked by default. Uncheck the check box if you do not want to swap to the Casebook app when creating a new case.

  • Observable Sort - Click the option to sort the list of observables in a case:

    • Newest - Displays the list of observables in the order the observables were added to the case, from newest to oldest.
    • Oldest - Displays the list of observables in the order the observables were added to the case, from oldest to newest.
    • Alphabetical - Displays the list of observables in alphabetical order, from A to Z.

  • Reset - Click Reset to Defaults to reset all settings for casebook to its default values.

On the Settings page, click Notifications in the left navigation pane to configure settings for ribbon notifications. Click the Do Not Disturb toggle to enable or disable the toasts for incoming notifications and the number of unread notifications displayed on the Notifications icon in ribbon. The toggle is off by default; if you want to enable the option, click the Do Not Disturb by toggle to on.

On the Settings page, click Pivot Menu in the left navigation pane to enable or disable the Copy defanged value menu option in the Pivot menu. The Copy defanged value menu option allows users to copy a defanged observable value to the clipboard from the Pivot menu, preventing users from accidentally clicking a malicious link when it is pasted for later use elsewhere. For more information on copying a defanged value, see Pivot Menu. The toggle is off by default. Click the Defang on Copy toggle to on to remove the Copy defanged value option from the Pivot menu and update the Copy value option in the Pivot menu to copy an observable value as a defanged value.