Previous Release Notes for Cisco XDR in 2023
2.9
Release Date: December 6, 2023
New Features and Updates
Getting Started
Control Center
Incidents
No new customer-facing features or updates in this release.
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Updated Workflows in Exchange |
Exchange enables you to find, install, and use workflows that have been built and approved by Cisco engineers and content providers. Now you can collectively see all the workflows you have installed from Exchange, and when a workflow configuration or object is changed, you're shown and given the option to update to the newer version. Exchange indicates when the workflow was installed in your tenant and whether an update is available for it now. |
|
|
Help Updates |
The following help topic has been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Cisco Integration Support |
The Cisco Duo integration now provides user data for the Users page. |
|
|
Third-Party Integration Support |
The Cybereason third-party integration now provides device data for the Devices page. |
|
|
Device Details Drawer |
A new Device Details drawer provides an overview of the data associated with the selected device. Click a Device Name to open the Device Details drawer. |
|
|
Help Updates |
The following updates have been made to the help:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Deployments |
The process to create new deployments and edit existing deployments has been updated to a stepped wizard. On the Deployments page, click Create New to open the Create Deployment page, which will guide you through a step by step process to create new deployments. |
|
|
Device Details Drawer |
A new Device Details drawer provides an overview of the data associated with the selected device. Click a Device Name to open the Device Details drawer. |
Clients |
|
Help Updates |
The following updates have been made to the help:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Cisco Integration Added to Integrations Page |
The new Webex integration has been added to the Integrations page. Webex offers secure, integrated audio, video, and content sharing from any device, anywhere. Intelligent features such as noise removal, Webex Assistant, with real-time translations and People Insights automate meeting tasks to help you work smarter. In Cisco XDR, integrating Webex allows you to send notifications from your XDR automation workflows. |
Cisco and Third-Party Integrations and Supported Capabilities Cisco Integrations |
|
Help Update |
Updated the Asset Inventory and Context column from No to Yes for the Cybereason integration in the Cisco and Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Pivot Menu Updates |
The following updates have been made to the Pivot menu:
|
|
|
Automation Workflow Notification |
A new Automation Workflow notification has been added to Notifications in Cisco XDR ribbon and it is displayed in the Notifications popup and on the Notifications page when an Automation workflow or rule is temporarily disabled. |
|
|
Help Updates |
Updated the Pivot Menu, Investigate Using Ribbon Extension, Casebook App, and Observables topics with new screenshots of the pivot menu to align with the UI. |
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the help:
|
Third-Party Integrations Cisco Integrations |
2.8
Release Date: November 22, 2023
New Features and Updates
Getting Started
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Customize Dashboards Updates |
The following changes have been made to the Customize Dashboards dialog box:
|
|
|
Control Center Page Update |
The Edit Dashboards button on the Control Center page has been renamed to Customize Dashboards. |
Incidents
No new customer-facing features or updates in this release.
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Sync and Highlight Asset Labels |
The sync and highlight functionality has been extended to include asset labels. You can now select a label for an asset in the Assets and Observables panel or Asset Labels drawer to highlight all asset nodes in the Relations Graph panel that contain that asset label. This, in turn, highlights all other assets in the Assets and Observables panel, Indicators panel, and Events table that are associated with the nodes highlighted in the Relations Graph panel. Asset labels are present if the asset is assigned labels in Cisco XDR Devices. To select multiple labels in the Assets and Observables panel, press the ctrl key (Windows) or command key (Mac) while clicking the labels or use the |
|
|
Asset Labels Drawer |
The number of labels displayed in the Assets and Observables panel depends on the length of the label. Any additional labels are indicated by a +n value (for example, +1). To view all the labels, click the +n link to open the Asset Labels drawer. From the drawer, you can see all the labels that are associated with the asset. You also have the same functionality to sync from the drawer as you do from the Assets and Observables panel. |
|
|
Timeline Refresh |
A new |
|
|
Help Updates |
The following updates have been made to the Help:
|
(Select) icon in the Graph Controls.
(Timeline Refresh) icon has been added to the Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Automation Rules |
Use Automation Rules to configure when a workflow is automatically executed, such as according to a schedule or in response to an incident or specific event. The ability to add Automation Rules directly to a workflow is now included in the Workflow Editor for quicker access and enhanced usability, where you can select rule types, add one or more rules, and activate an association between the workflow and each rule, so that the workflow is enabled to automatically run when the rule conditions are met. |
|
|
New Workflow |
XDR - Automation Rule - Update Incident Properties workflow released. This new workflow can be used with Incident Automation Rules to update an incident's properties. For example, you may use this workflow to automatically assign specific incidents to a certain person. Supported properties include assignees, description, short description, title, status, and severity. |
|
|
Help Updates |
The following help topics have been updated:
|
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The new Cohesity Data Cloud third-party integration is now available on the Integrations page. Integrating Cohesity DataProtect with Cisco XDR allows SOC and IT teams to automatically take a snapshot of business-critical data as often as needed, early in the incident response process. Automated workflows also allow teams to rapidly recover impacted assets from recent and immutable backup snapshots. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
User ID Added to My Account Page |
A new User ID field has been added to the My Account page. |
|
|
Help Update |
Updated the Asset Inventory and Context column from No to Yes for the Trend Vision One integration in the Cisco and Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Orbital App Updates |
The following updates have been made to the Orbital app in Cisco XDR ribbon:
|
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated the description for the Trend Vision One integration to include device inventory feature support in the Third-Party Integrations topic. |
Third-Party Integrations |
2.7
Release Date: November 8, 2023
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
A new Getting Started topic has been added to help users sign in, configure, and use the basic features of Cisco XDR. |
Control Center
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Assets in Incidents List and Assets Drawer |
A new Assets column in the Incidents list shows the top asset associated with the incident based on asset value and the value that has been assigned to it (if available). If there are multiple assets associated with an incident, click +more in the Assets column beneath the asset name to open the Assets drawer. The Assets drawer shows all the assets associated with the incident and the number of events where the asset was seen. |
|
|
Search Incidents by Asset Name |
You can now search the Incidents list by asset name. Enter the exact asset name in the Search field to find the incidents that include the original assets as an exact match. |
|
|
Help Updates |
The following help topics have been updated:
|
Incidents |
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Approval Task Notification |
Creating an approval task will now notify the assignees through the Notifications icon in the Cisco XDR ribbon that they have been assigned a task and provide a link to review the task and approve or reject the request. |
|
|
Help Updates |
The following help topic has been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
CrowdStrike Integration Update |
The CrowdStrike third-party integration is now included in the Cisco XDR correlated incident creation. CrowdStrike security events can now generate and contribute to incidents in Cisco XDR, in addition to existing sources from Cisco Secure Firewall, Cisco Secure Endpoint, Cisco Secure Network Visibility Module, and the network and cloud detections that are natively built into Cisco XDR analytics. |
Third-Party Integrations |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Ribbon Extension |
The new Cisco XDR ribbon extension is now available for the Google Chrome, Mozilla Firefox, and Microsoft Edge browsers. The Cisco XDR ribbon extension offers a distributed set of capabilities that unify visibility, enable automation, accelerate incident response workflows, and improve threat hunting directly from your browser. |
|
|
Automation Approval Task Notification |
A new Automation Task Approval notification has been added to Notifications in Cisco XDR ribbon and it is displayed in the Notifications popup and on the Notifications page when an approval task from Automation is assigned to you by other users. |
|
|
Help Updates |
The following help topics have been updated:
|
(Options) icon to the Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following help topics have been updated:
|
Third-Party Integrations |
2.6
Release Date: October 25, 2023
New Features and Updates
Control Center
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Workflow Run Drawer |
You can now view a high-level summary of an executed workflow in the Workflow Run drawer on the Response page, including information such as the workflow title, who it was started by, start and end date and time, status, and inputs. To open the Workflow Run drawer on the Response page, click View in the Actions taken panel next to the executed workflow. Click View run details to open the full Workflow Properties and view complete information about the workflow run in Cisco XDR Automate. |
|
|
Source in Event Drawer Linked to Integration Instance |
The Source field in the Event drawer is now linked to an instance of the integration that reported it. |
|
|
Help Updates |
The following help topics have been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Investigation Filters |
By default, all investigation data (internal and external to your environment) is shown on the Relations Graph, Assets and Observables, and Indicators panels on the Investigation Results page. The Events table shows only events from your environment by default. New check box filters have been added to the Investigation Results page and to the Events table that allow you to toggle between showing only data internal to your environment or showing all data (internal and external to your environment). My Environment Only FilterIn the upper portion of the Investigation Results page, the My environment only check box is available to filter the overall investigation results to show only data that is internal to your environment. When this check box is checked, all data outside of your environment is excluded. The Events table is forced to display only events from your environment and the My environment events only check box for the Events table is disabled. My Environment Events Only Filter On the Events table, the My environment events only check box is available to filter for all events (internal and external to your environment) or only events internal to your environment. By default, the check box is checked to show only events internal to your environment, as indicated by the You can uncheck the check box to show all events in the Events table if the My environment only check box in the upper portion of the page is unchecked. Note: If the My environment only check box is checked, the My environment events only check box becomes disabled and cannot be toggled to show all events (internal and external) because the page filter overrides the Events table filter. |
|
|
Source in Event Drawer Linked to Integration Instance |
The Source field in the Event drawer is now linked to an instance of the integration that reported it. |
|
|
Help Updates |
The following help topics have been updated:
|
(Internal Event) icon. Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Workflow Drawer |
On the Workflows page, click on a workflow to open a drawer on the right that displays a high-level summary including description, categories, response actions, variables, triggers, and targets. Click View workflow to see more information in the Workflow Editor. |
|
|
Cisco XDR Licensing Tier Enforcement |
Third-party integrations and their components will not appear for use in Automation if your organization’s licensing tier is Cisco XDR Essentials. You can view your Organization Tier on the My Account page. At the bottom of the Integrations page, a message is displayed with additional information on how to upgrade your license to Cisco XDR Advantage or Cisco XDR Premier to benefit from third-party integrations. For details on the licensing tiers, see Cisco XDR Licenses. |
— |
|
Updated Atomic Actions |
Orbital and Umbrella (v2) atomic actions have been updated to support integration-provided targets. |
— |
|
Updated Workflows |
These existing workflows have been updated:
|
— |
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Devices and Users Tables |
You can now click and drag column headers to reorder the columns in the Devices and Users tables. |
|
|
Help Updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The new Darktrace RESPOND & DETECT third-party integration is now available on the Integrations page. Use the Darktrace integration to query for security detections of observables including IP, hostname, and Darktrace device ID. It also enables users to leverage the integration for threat hunting and investigation features. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
Umbrella Integration Update |
New API settings have been added to the Add Integration form for Umbrella. You can now provide one API key for multiple Umbrella functions (Reporting, Network Devices, and Management). |
— |
|
Help Updates |
Updated the My Account and Users topics with new screenshots to align with the UI. |
Ribbon
Resources
2.5
Release Date: October 4, 2023
New Features and Updates
Control Center
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Events label added to table on Detection page |
Previously, there was no label on the table on the Detection page in the incident details. The table now includes the Events label to give users a better understanding of what is being displayed. |
|
|
Help Update |
Updated the screenshot in the Incidents Detection topic to show the Events label on the table. |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Relation Graph Filter Badge |
When filters are applied to the Relations Graph using the |
|
|
Help Updates |
Updated the Relations Graph and Investigation Results topics to include new Filter menu screenshot and information about the new badge when filters are applied. |
(Filter) icon in the graph control, the number of selected filters is now displayed as a badge on the icon so you have a visual of how many filters have been applied once the Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Atomic Actions |
The following new atomic actions are now available in Exchange:
|
|
|
Large String Variables |
For strings greater than 1 MB in size that are needed as inputs to other activites in your workflow, we've added a new Large String workflow variable data type that supports strings up to 10 MB in size. |
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Rules Drawer |
The Rules drawer now has an Options menu where you can choose to edit or delete the rule. |
Devices |
|
Edit Columns |
The Edit Columns button on the Devices and Users page has been removed and you now use the |
|
|
Help Updates |
The following help topics have been updated:
|
(Edit Columns) icon in the table header to select which columns to display.Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Edit Columns |
The Edit Columns button on the Clients page has been removed and you now use the |
|
|
Help Updates |
Updated the Clients topic to include new Sort and Edit Columns section and updated screenshots to align with the UI. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The new ExtraHop Reveal(x) 360 third-party integration is now available on the Integrations page. Integration with ExtraHop Reveal(x) Enterprise allows you to automatically search for devices, add or remove devices from a watchlist, and search for detections. This integration also creates an HTTP target automatically in Automation for out-of-box workflows. |
Third-Party Integrations |
|
Help Updates |
The following help topics have been updated:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Pivot Menu Icons Added to Assets |
When you view incidents in the incidents app, each asset listed in the Incident Overview panel now has a |
(Pivot Menu) icon. This enables you to perform actions directly in the Pivot menu or pivot to the integrated product to perform additional actions.Resources
2.4
Release Date: September 20, 2023
New Features and Updates
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Tile Name and Data Format Updates |
The Incident statuses and assignees tile has been renamed to Incident Status by Assignment and the tile data format has been updated from a donut chart to a horizontal bar chart. Note: If you have an existing Incident status and assignees tile on your dashboard, an error message is displayed on the tile. You must remove the tile from the dashboard and then add the new Incident Status by Assignment tile to your existing dashboard. For details on removing tiles and modifying tiles on a dashboard, see Configure Dashboards and Cards. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Disposition Filters in Observables Drawer |
You now have the ability to filter observables by disposition in the Observables drawer on the Overview page in the incident details. The filter labels indicate how many observables are associated with each disposition. Click the Disposition filter in the upper portion of the drawer to narrow the display of observables with that disposition. |
|
|
Help Updates |
The following help topic has been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Attributes in Node Drawer Sorted by Type |
When a node is selected in the graph, the attributes listed in the Node drawer are now sorted alphabetically by type. |
|
|
Filter Investigation Results |
The investigation results show nodes from all sources and dispositions by default. You can now filter the nodes using the Sources and Disposition filters to narrow the display and show only those nodes that match the filters you have selected. When filters are used, they apply to all to all panels on the Investigation Results page.
|
|
|
Help Updates |
The following help topics have been updated:
|
Intelligence
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Updated Environment Filter |
The environment filter label on the Events page now displays as Environment until you choose the filter (All, Internal, or Global). |
|
|
Help Updates |
The following help topic has been updated:
|
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Run Drawer |
On the Runs page, click on a run to open a drawer on the right that displays a high-level summary of the workflow execution. Then click View run details to see more information. |
|
|
Array Operator Labels in Rule Conditions |
When building an automation rule, for array variables in conditional statements, the comparison operator labels have been updated for clarification. In the variable browser, choose All Items (list) to check if any item in the array matches the criteria. |
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following has been updated on the Sources help topic:
|
Client Management
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The Palo Alto Networks Cortex XDR third-party integration is now available on the Integrations page. Integration with Palo Alto Networks Cortex XDR allows Cisco XDR to leverage Cortex response actions to respond to incidents or proactively mitigate threats in the following ways: add files to blocklists, quarantine or unquarantine endpoints, and perform malware scan on endpoints. This integration also creates a target automatically in Automation for out-of-box workflows. |
Third-Party Integrations |
|
Added Organization Tier Information to My Account Page |
The Organization Tier field has been added to the My Account page with the licensing tier information for your organization. For details on the licensing tiers, see Cisco XDR Licenses. |
|
|
Added Cisco XDR Essential Licensing Tier Enforcement |
All third-party integrations now require Cisco XDR Advantage or Cisco XDR Premier licensing tier. If the licensing tier for your organization is Cisco XDR Essentials, a message is displayed at the bottom of the Integrations page with additional information on how to upgrade the license or learn more about custom integrations. |
Third-Party Integrations |
Ribbon
No new customer-facing features or updates in this release.
Resources
2.3
Release Date: September 6, 2023
New Features and Updates
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Scroll Incidents Using Arrow Keys |
You can now scroll the list on the Incidents page using the up and down arrow keys on your keyboard. If the Incident drawer is open, the drawer is populated with information for the selected incident as you scroll. |
|
|
Improved Playbook Task Descriptions |
The tasks in the playbook on the Response tab in the Incident detail have been rewritten to improve useability. |
|
|
View Asset Information |
A new View asset information link has been added to the Pivot menu for device assets. When you click the link, it opens a new tab and the device information is displayed on the Device Details page. |
|
|
Help Updates |
The following help topics have been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Sync and Highlight Investigation Results |
With the sync and highlight capability, you can now easily see the associated assets, observables, and indicators in the panels when nodes are selected in the Relations Graph panel. You can also select assets, observables, and indicators in the Assets and Observables panel and the Indicators panel to highlight the nodes in the Relations Graph panel. To select multiple assets, observables, and indicators in the panels, the ctrl key (Windows) or command key (Mac) while clicking the items in the list. To select multiple nodes in the graph, press the ctrl key (Windows) or command key (Mac) while clicking the nodes or use the |
|
|
Edit Saved Investigation Name in Investigation Results |
You now have the ability to edit the name of a saved investigation when viewing the investigation on the Investigation Results page. Hover over the name of the saved investigation and click the |
|
|
Updated Button to Save Investigation |
To save an investigation on the Investigation Results page, you now click Save instead of Save Investigation. In addition, when viewing a previously saved investigation, the Save button is hidden on the page. |
|
|
Help Updates |
The following help topics have been updated:
|
(Select) icon in the Graph Controls.
(Edit) icon to enter a new name.Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Automation Rules |
Workflow parameter data can be hard-coded or, if the workflow has input variables, you can use the variable browser to select event input/output variables. |
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Added a note on the Sources page for device value indicating rule assigned if the value is set using a custom source. |
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated the Default Deployment screenshots on the Deployments page. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
My Account |
The My Account page is now a separate option under Administration in the navigation menu. |
|
|
Change User Role |
The Logout button is now Refresh in the popup that notifies the user if their role has been changed. |
|
|
Update Existing Third-Party Integration on Integrations Page |
The Trend Micro third-party integration has been renamed to Trend Vision One. |
Third-Party Integrations |
|
Help Updates |
The following help topics have been updated:
|
Ribbon
No new customer-facing features or updates in this release.
Resources
2.2
Release Date: August 23, 2023
New Features and Updates
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Highlighted Text Added to Assignee Widget |
Enhancements have been made to the Assignee widget to help you quickly find the name in the search results. When you begin entering letters in the Search field, the matching letters are highlighted bold in the returned list. |
|
|
Help Updates |
The following help topics have been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Group Nodes Capability |
You can now group the nodes on the Relations Graph to simplify the view and reduce the noise. The grouping capability is turned on by default when the node count is 20 or higher. Nodes are grouped if they are the same type, same disposition, or have the same relationship, which means they share the same types of relationships to the same set of observables. You can turn on or turn off the grouping capability using the
|
|
|
Help Updates |
The following help topics have been updated:
|
(Group) icon and 
(Ungroup) icon in the Graph Controls on the Relations Graph.Intelligence
No new customer-facing features or updates in this release.
Automate
No new customer-facing features or updates in this release.
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Users |
Users is now available in Cisco XDR. This feature pulls user data from the Microsoft Azure Active Directory - Users third-party integration, and provides an overview of the data in a table on the new Users page in the Assets section of the navigation menu. Note: The Users feature is subject to change while in Beta. |
|
|
Add a Custom Source |
The custom source CSV upload now supports adding labels and device value to devices. |
|
|
Help Updates |
The following help topics have been updated:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Upload Profile |
The Upload Profile modal has been updated to improve user experience. |
|
|
Profile Configuration |
When you create, edit, or view a profile, the Profile Configuration page now allows you to minimize and expand the sections for each setting. |
|
|
Help Updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The Microsoft Azure Active Directory - Users third-party integration is now available on the Integrations page. Integrating Microsoft Azure AD with Cisco XDR provides user and device information to the Cisco XDR Assets feature and it enriches investigations and incident triage and response with device and user context. |
Integrations
Third-Party Integrations |
| Confirmed Users Page Update |
If an Administrator changes the role of an existing user and the user with the changed role is logged in to Cisco XDR, a popup message notifying the user of the change is now displayed. The user must log out of Cisco XDR and the new role is applied the next time the user logs back in. |
Users |
|
Update to Secure Access by Duo integration on Integrations Page |
The Secure Access by Duo integration has been renamed to Cisco Duo. |
Cisco Integrations |
|
New Cisco Integrations Added to Integrations Page for Asia Pacific, Japan, China Region Only |
The Secure Email Threat Defense (Australia) and Secure Email Threat Defense (India) integrations have been added to the Integrations page for the Asia Pacific, Japan, China region only. |
|
|
New Scope Added to API Clients |
A new scope (AO) has been added to the Add New Client dialog box when you click Generate API Client on the API Clients page. The AO scope is used to manage and execute Automation workflows and related objects. |
— |
|
Help Update |
Added View Users under Assets in the Roles table. |
Ribbon
No new customer-facing features or updates in this release.
2.1
Release Date: August 9, 2023
New Features and Updates
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
New screenshot showing updated navigation menu. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Assets Panel in Incident Drawer |
A new Assets panel is included in the Incident drawer and is expanded by default. This panel displays the total number of unique assets through all of the events related to the selected incident. These are the same assets that are displayed in the Assets drawer on the Overview page in the Incident Details. The assets are represented by an icon that allows you to easily distinguish the asset type. Each asset includes a |
|
|
Help Updates |
Updated screenshots showing new navigation menu. |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Customize Layout on Investigation Results Page |
You can now choose how you want the panels on the Investigation Results page to be displayed. Click the Layout button in the upper right corner of the page and choose one of the following layouts:
|
|
|
Help Updates |
Updated screenshots showing new navigation menu. |
Intelligence
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated screenshots showing new navigation menu. |
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Uninstall Workflow from Exchange |
You can now uninstall a workflow from Exchange and remove it from your tenant. |
|
|
Help Updates |
New integration targets. |
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Navigation Menu Updates |
The Devices feature has been renamed to Assets and the Inventory page has been renamed to Devices in the navigation menu. The following pages are now located under the new Assets section:
|
|
|
Add Labels to Devices |
Updated the help documentation for the Labels drawer. |
|
|
Help Updates |
New screenshots showing updated navigation menu. |
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Navigation Menu Updates |
The Secure Client feature is now a separate section in the navigation menu. The following pages are now located under the new Client Management section:
|
|
|
Profiles Option Menu |
The Profiles page now has an Option menu where you can perform the following tasks:
Note: You cannot edit or delete default profiles. You cannot copy or download the NVM Cloud Default Profile. |
|
|
Deployments Page Enhancements |
The following enhancements have been added to the Deployments page:
|
|
|
Help Updates |
New screenshots showing updated navigation menu. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Updates to Cisco integrations on Integrations Page |
The following integrations have been renamed to align with the rebranding initiative:
|
|
|
Help Updates |
The following is a list of Help updates for this release:
|
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated screenshots to align with the Orbital app UI. |
2.0
Release Date: July 26, 2023
This is the general availability release of Cisco XDR.