Navigate Cisco XDR

The Cisco XDR Control Center pages provide visibility and aggregate, actionable intelligence across your organization and a comprehensive visualization of the tactics and techniques that are covered by the Cisco Breach Protection Suite products.

See Control Center for more information.

The Cisco XDR Incidents list helps you minimize the time spent on detection and response of correlated security events by providing the most critical information needed to detect, triage, investigate, and respond all in one place. With risk-based prioritization of security detections, you can focus on the most critical incidents and view recommendations that enable you to immediately diagnose, contain, and remediate the incident.

With Cisco XDR Incidents feature, you can:

• View a list of incidents, prioritized by severity and risk.

• Open the Incident drawer and view a high-level summary of the incident in one place.

• Dive deeper into the incident details to gain an understanding of the threat and quickly triage and remediate it.

Click Incidents in the left menu to view the automatically enriched incidents that have been promoted to Cisco XDR.

See Incidents for more information.

In an intelligence-driven incident response, a piece of disseminated information may be the starting point for a security team to investigate the impact of a known piece of malware. The Cisco XDR Investigate feature is used to search suspicious indicators of compromise (IOCs) such as emails, log messages, domains, URLs, and IPs, and extract observables for enrichment.

Cisco XDR reaches out to all of the configured sources (configured modules) and finds the disposition for each observable. Once a target has been identified, you can direct attention immediately to the target to gain contextual knowledge of exactly which observable(s) the target has communicated with.

Click Investigate in the navigation menu to begin an investigation.

See Investigate for more information.

The Cisco XDR Intelligence feature provides users the ability to search for stored threat intelligence from the public, as well as your private, threat intelligence stores based on the Cisco Threat Intelligence Model. It includes the judgments, indicators, events, and feeds based on the data that has been extracted from the continuous enrichment of our threat intelligence sources and deemed most relevant to incident response.

In the navigation menu, expand Intelligence and choose to view Judgments, Indicators, Events, and Feeds.

See Intelligence for more information.

The Automation feature provides a framework to automate security processes such as threat investigation, hunting and remediation to strengthen operational efficiency and precision.

Cisco XDR Automation enables you to define workflows to reflect your typical security processes; the automation steps (activities), the logic or flow between these steps, and how to flow data from one step to the next. With Cisco XDR, you can leverage Cisco and third-party multi-domain systems, applications, databases, and network devices in your environment to create these workflows.

See About Automation for more information.

The Cisco XDR Assets feature provides a unified view of the devices and users in your organization by consolidating inventories from integrated data sources, such as Duo, Secure Endpoint, Orbital, Umbrella, and Meraki.

See Assets for more information.

The Cisco XDR Client Management feature is the next generation Secure Mobility Client that combines the existing features of both AnyConnect and Secure Endpoint with a Cloud Management solution in a single unified end-user interface.

See Client Management for more information.

The Administration pages are used to view your account information, view your notifications, manage incident response playbooks, configure devices and API clients, and manage existing users and invite users to your Cisco XDR organization. You can also view the security products that are integrated with Cisco XDR on the Integrations page. Each source of global or local intelligence is provided by an integration and is linked via an API key.

See Administration for more information.

You can search and filter all your notifications to display only those notifications you want to view in the Notifications popup. Click Clear filters to remove the search criteria and filter.

To search for notifications, enter the search criteria in the Search text box in the Notifications popup to search for notifications by type or details. The notifications that match your search criteria are displayed in the Notifications popup.

To filter the notifications, click the Date drop-down and choose the date range for the notifications you want displayed in the Notifications popup.

Click Logout next to your user name to log out of Security Cloud Sign On account and Cisco XDR.

If you are a member of two or more organizations within a region, you can switch to a different organization in the User Profile drop-down menu by clicking the organization link. Once you choose an organization, you are automatically log in to Cisco XDR for the selected organization.

Search Organizations

If there are seven or more organizations listed in the User Profile menu, a Search organizations text box is displayed. Enter the search criteria in the Search organizations text box to search for organizations by organization name. The organizations with the name that match your search criteria are displayed in the User Profile menu.

You can view the system status from the System Status option in the User Profile menu. The system status is shown using the following color indicators:

• Blue - All Systems Operational

• Yellow - Partial System Outage

• Red - Major Service Outage

For more information on the system status, see Cisco XDR Service Status Home Page.

You can choose the color theme in which to display the Cisco XDR user interface. The default color theme displays a light background; dark color theme displays a dark background.

To change the color theme, click the Light or Dark.