Previous Release Notes for Cisco XDR in 2025

Help update

Added new OVA file information to Configure and Deploy the Virtual Appliance in the Remote Setup and Deployment topic.

Apply and Cancel buttons removed from Filters drawer

The Apply and Cancel buttons have been removed from the Filters drawer on the Incidents page. The filter criteria is now automatically applied and the incidents list refreshes as you select the filter criteria.

Help update

Added a note to the SMTP Endpoint Target topic to explain why it no longer works for Gmail accounts.

Help update

The following update has been made to the Help:

• Added a note to the Devices topic to explain that it can take up to 15 minutes for new or updated rules to be applied to existing devices.

Help update

The following update has been made to the Help:

• Added a note to the Deployment Management topic to clarify that Cisco Support does not assist with troubleshooting third-party software management tools.

Help updates

The following updates have been made to the Help:

• The following integration topics have been updated to include Detection findings in the What's Next section: Secure Endpoint Integration, Secure Network Analytics Integration, Secure Email Threat Defense Integration, Secure Access Integration, CrowdStrike Falcon Integration, Microsoft Defender for Endpoint Integration, Microsoft Defender for Office 365 Integration, SentinelOne Singularity Integration, and Proofpoint Threat Protection Integration.

• The Google SecOps integration has been tested and certified by Cisco Quality Assurance labs and it has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as supported third-party integration in Cisco XDR.

• Updated the Cisco Identity Intelligence Integration topic to include a list of supported integrations.

• Updated the Configure GCP to Generate VPC Flow Logs and Enable APIs section of the Google Cloud Platform Integration topic.

MITRE tactic updates in ribbon

The MITRE TTP widget in the upper right corner of an incident in the incidents app in ribbon is now a MITRE tactic tag. Click the tag to open the MITRE Tactics popup to view a list of tactics and techniques impacting the incident.

Events table updates on the Detection page

The following updates have been made to the Events tab on the Detection page in incident detail:

• You can now drag column headers to reorder the columns.

• The new (Settings) icon has been added to the events table for customizing the columns.

Events table updates on the Investigation Results page

The following updates have been made to the Events tab on the Investigation Results page in incident detail:

• You can now drag column headers to reorder the columns.

• The new (Settings) icon has been added to the events table for customizing the columns.

Webhook API key

To improve security, the API key for webhooks has been moved from the webhook URL to the new x-automate-api-key header.

Help update

The following update has been made to the Help:

• Added dashboard cards for the Red Sift Pulse integration to the Integration Cards topic.

Help updates

The following updates have been made to the Help:

• Updated the Group/Ungroup graph control description in the Overview topic.

• Updated the Incidents topic to remove an outdated note.

Last seen added to Event drawer

The Event drawer on the Investigation Results page now displays the Last seen date and time, if applicable.

Help updates

The following updates have been made to the Help:

• Updated screenshots in the following topics to align with the UI: Intelligence, Judgments, Indicators, Events, and Feeds.

Help updates

These updates have been made to the Help:

• Added a link to Cisco XDR Connect to the Atomic Actions topic.

• Added a link to Cisco XDR Learning Labs to the Frequently Asked Questions topic.

• Added Remote package file name information to the Remote Setup and Deployment topic.

Help updates

The following updates have been made to the Help:

• Added Google Cloud Platform to the Sources topic.

• Updated screenshots in the Users and User Details topics to align with the UI.

Help update

The following update has been made to the Help:

• Added a note to the Deployment Management topic to clarify if your endpoint does not have OpenGL installed, you will need to install the deployment using -q in the command line.

On-Premises Appliances page updates

The previous Generate Token and Delete icons in the Actions column are now menu items when you click the new (Ellipsis) icon in the Actions column.

Help updates

The following updates have been made to the Help:

• The following integration topics have been added to the Cisco XDR help: Microsoft Graph Security API Integration, Microsoft Intune Integration, PagerDuty Integration, Rubrik Security Cloud Integration, ServiceNow Integration, Omnissa Workspace ONE UEM Integration, xMatters Integration, MISP Integration, Graylog Cloud Integration, Palo Alto Networks Firewalls with Strata Logging Service Integration, Palo Alto Networks Cortex XDR Integration, Radware Cloud DDoS Protection Service Integration, Radware Cloud WAF Service Integration, Red Sift Pulse Integration, and Trend Vision One Integration. The link to the topic has been added to the Cisco and Third-party Integrations and Supported Capabilities topic.

• The Attack Surface Management Integration topic has been removed from the Cisco XDR help.

• The MISP and Graylog Cloud integrations have been tested and certified by Cisco Quality Assurance labs and they have been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as supported third-party integrations in Cisco XDR.

• Updated the Dashboard column from No to Yes for the Red Sift Pulse integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• Updated the Cisco and Third-party Integrations and Supported Capabilities topic to include a note to follow the configuration steps for any of the integrations.

Help update

The following update has been made to the Help:

• Updated the Incident Rules link to Incident Response Rules in the Assignment Rules topic.

Actions Taken panel update

The Actions Taken panel in the Node drawer now displays observable data for the remedial actions, if available.

Help updates

These updates have been made to the Help:

• Added how to avoid a timeout from paginated output to the Execute Terminal Command(s) topic.

• Added a note about the upload and download activities to the File Operations topic.

• Added the size limits for emails to the Email Rule topic.

• Added the payload size limit for webhooks to the Webhook Rule topic.

• Added a link to Cisco XDR Connect to the Workflows topic.

Help updates

The following updates have been made to the Help:

• Added Google Chromebooks to the Sources topic.

• Renamed the VMWare Workspace One UEM integration to Omnissa Workspace ONE UEM in the Sources topic.

Help updates

The following updates have been made to the Help:

• Added a note to the Create Deployment topic explaining that modules with a specific release version selected in a deployment will be disabled if the version has been deprecated.

• Added the Operating System and Architecture Support section to the Create Deployment topic.

Slack integration scopes updated on Slack integration page

The required scopes for the Slack integration on the Integrations page have been updated to include additional scopes needed for the notification feature. If you have an existing Slack integration configured, you must update the scopes for your Slack app to match the scopes listed for the Slack integration in Cisco XDR. After you update the scopes, you will need to reinstall the Slack app to your workspace to allow the new scopes to take effect. For details, including the updated scopes list, see the Integration Guide area on the Slack integration page in Cisco XDR.

System Status area removed from User Profile

The System Status area has been removed from the User Profile drop-down list in the upper right corner of the Cisco XDR header.

Help updates

The following updates have been made to the Help:

• Added the ATT&CK version number and version history link to the MITRE ATT&CK^® Coverage Map topic.

• Added links to the integration topics in the list of product integrations.

Download events in JSON format on Detections page

You can now download the events in the detections table in JSON format. Click the new Download JSON button on the Detection page in incident details.

Detection findings tab added to the Investigate page

You can now view all the security events generated by integrated products and the Cisco XDR native telemetry sent from the Network, Cloud, Identity, and Endpoint sources in the new Detection Findings tab on the Investigate page. The security events allow you to validate the data that is ingested by Cisco XDR for incident correlation.

When you click a security event in the list, the Detection Findings drawer opens where you can quickly view the Detection Findings and related Activities from the security event. The security event details are displayed using the Industry Standard Open Cybersecurity Schema Framework (OCSF), version 1.4.

Help updates

The following updates have been made to the Help:

• Added new targets for the Cisco Identity Intelligence and Splunk Enterprise integrations to the Targets Created From Integrations topic.

• Added a new OVA file to Configure and Deploy the Virtual Appliance in the Remote Setup and Deployment topic.

• Renamed Incident Rule to Incident Response Rule in pertinent topics.

Help updates

The following updates have been made to the Help:

• Updated the Users and User Details topics for the Cisco Identity Intelligence integration support.

• Added Cisco Identity Intelligence to the Sources topic.

Help updates

The following updates have been made to the Help:

• Updated the Create Deployment and Deployment Management topics for Orbital and Secure Access Root Certificate support.

• Updated the screenshots in the Create Deployment, Deployment Management, and Deployments topics to align with the UI.

The following updates have been made to the Help:

• Updated the Asset Insights and Context column from Yes to No for the Microsoft Entra ID integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• The following integration topic has been added to the Cisco XDR help: Microsoft Entra ID Integration, Pulsedive Integration, Slack Integration, Threatscore Integration, urlscan.io Integration, and VirusTotal Integration. The link to the topic has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic.

Help updates

The following updates have been made to Help:

• Added a note to the View AI-Generated Summary Information section in the Report topic to clarify that the endpoint data timestamp displayed is the detection time.

• Added a link to the Incident Rule topic in the Assignment Rules topic.

Unknown disposition icon removed from investigate

The (Unknown) disposition icon has been removed from the relations graph nodes and observables on the Investigation Results page. No icon is displayed if the node or observable has an unknown disposition.

Unknown disposition icon removed from intelligence

The (Unknown) disposition icon has been removed from the observables on the Intelligence page. No icon is displayed if the observable has an unknown disposition

Condensed display fields for input variables in atomic and child workflow properties

We've made it easier to configure and scan through input variables in atomic and child workflows. In the Workflow Editor, when you click the atomic or child workflow to view its properties, expand the Input section. We've condensed the editor windows to reduce the amount of up and down scrolling in the Properties panel.

For example, for input values in JSON format:

• When the value is empty, just one blank line is shown, to avoid taking up unnecessary space.

• While entering or editing the value, the field is expanded to show more lines for a better editing experience.

Help update

The following update has been made to the Help:

• Added Microsoft Defender for Endpoint GCC to the Sources topic.

Help updates

The following updates have been made to the Help:

• Updated the Create Deployment topic for Windows arm64 support.

• Updated the screenshots in the Create Deployment and Device Events topics to align with the UI.

On-Premises Appliances page updates

The following updates have been made to the On-Premises Appliances page:

• Customize Filters icon has been renamed to Filters.

• The (Refresh) icon is now a Refresh button to the left of the Generate Token button.

• The (Settings) has been replaced by the Actions column name.

The following updates have been made to the Help:

• The Sumo Logic Log Management integration has been tested and certified by Cisco Quality Assurance labs and it has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as supported third-party integration in Cisco XDR.

• Updated the Asset Insights and Context column from No to Yes for the Microsoft Defender for Endpoint GCC integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• The following integration topics have been added to the Cisco XDR help: Microsoft Defender for Endpoint Integration, Microsoft Defender for Office 365 Integration, Microsoft Defender for Endpoint GCC Integration, and Microsoft Defender for Office 365 GCC Integration. The links to the topics have been added to the Cisco and Third-Party Integrations and Supported Capabilities topic.

High Impact Incidents card removed from Dashboards

The High Impact Incidents card for Private Intelligence has been removed from the list of available cards in the Customize Dashboards dialog box.

If the High Impact Incidents card is in an existing dashboard, a message is displayed informing you that the card is no longer available. Click Remove to remove the card from the dashboard.

Incident correlation and analytics support for Cisco Secure Access integration

Security detections from Cisco Secure Access are now included in incident correlation and analytics in Cisco XDR.

Judgment Detail page added to Judgments tab on the Intelligence page

You can now click the new View judgment detail button in the Judgment drawer to open the Judgment Detail page. From this page, you can view an overview of the judgment, linked indicators, and the judgment in JSON format.

The following updates have been made to the Help:

• Updated the Detection Analytics and Correlation column from No to Yes for the Cisco Secure Access integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• The following integration topics have been added to the Cisco XDR help: Cohesity DataProtect Integration, Cybereason Integration, Darktrace /NETWORK Integration, Elastic Cloud Integration, ExtraHop Reveal(x) 360 Integration, Ivanti Neurons for MDM Integration, Jamf Pro Integration, and Jira Cloud Integration. The links to the topics have been added to the Cisco and Third-Party Integrations and Supported Capabilities topic.

Help updates

The following updates have been made to the Help:

• Updated the Secure Endpoint Configuration Insights section in the MITRE ATT&CK^® Coverage Map topic to improve readability.

• Updated the MITRE ATT&CK^® Coverage Map topic with a new screenshot in the Secure Endpoint Policy Drawer section to align with the UI.

Help update

The following update has been made to the Help:

• Updated screenshot in Incidents topic to align with the UI.

The following updates have been made to the Help:

• Updated the screenshots in the Investigate and Saved Investigations topics to align with the UI.

Help update

The following additional update has been made to the Help:

• Renamed the Cohesity Data Cloud target to Cohesity DataProtect in the Targets Created From Integrations Help topic.

Help updates

The following updates have been made to the Help:

• Reorganized multiple sections in the Devices and Users topics for the bulk action bar update.

• Updated the screenshots in the Devices topic to align with the UI.

Help updates

The following updates have been made to the Help:

• Updated the Move to Deployment section in the Clients topic.

• Added Zero Trust Access to the Secure Client Profiles section of the Profile Configuration topic.

• Added Zero Trust Access profile selection to the Create Deployment topic.

• Updated the screenshots in the Clients, Deployments, and Create Deployment topics to align with the UI.

API Clients page

The (View) icon has been removed from the Actions column on the API Clients page and you can now click the API client link in the list to view details of the API client.

The following updates have been made to the Help:

• The Have I Been Pwned integration has been tested and certified by Cisco Quality Assurance labs and it has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as supported third-party integration in Cisco XDR.

• The following integration topics have been added to the Cisco XDR help: Secure Firewall Integration, AbuseIPDB IPChecker Integration, AlienVault Open Threat Exchange Integration, MISP Integration, Check Point Quantium Smart-1 Cloud Integration, and Proofpoint Threat Protection Integration. The links to the topics have been added to the Cisco and Third-Party Integrations and Supported Capabilities topic.

Help updates

The following updates have been made to the Help:

• Updated the Secure Endpoint Configuration Insights section in the MITRE ATT&CK^® Coverage Map topic with a new note to specify the Secure Endpoint licensing tier required for the Orbital engine.

• Added note to the Secure Endpoint Policy Drawer section in the MITRE ATT&CK^® Coverage Map topic to ensure that the organization selected in Secure Endpoint must match the Secure Endpoint integration selected in the Secure Endpoint Configuration Insights drawer.

Help updates

The following updates have been made to the Help:

• A note has been added to the Response and Assignment Rules topics to notify users that it may take up to a few minutes for a custom playbook to be assigned to an incident.

Help updates

The following additional updates have been made to the Help:

• Added steps to the setup procedure in the Automation Remote Help topic that account for what to do when a certificate expires.

• Added new system objects for Cisco Security Cloud Control to the Atomic Actions Help topic.

• Renamed the Cisco Defense Orchestrator target to Cisco Security Cloud Control in the Targets Created From Integrations Help topic.

Device Details drawer updates

The following sources now provide additional characteristics in the Device Details drawer:

• Cisco Duo: Trusted Endpoint

• Microsoft Defender for Endpoint: Health Status, Risk Score, and Exposure Level

• Orbital: Windows Security Center (Only Windows devices)

• SentinelOne Singularity: Infected and Active Threats

Bulk device move to deployment

We now support moving up to 500 devices at a time when moving devices to another deployment.

Help updates

The following updates has been made to the Help:

• Updated the API Clients topic with new View API Client and Delete API Client sections.

• Updated the screenshot in the API Clients topic to align with the UI.

Help updates

The following updates have been made to the Help:

• Added the Shodan Integration topic to the Cisco XDR help. The link to the topic has been added to the table in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• The IBM X-Force Exchange integration has been tested and certified by Cisco Quality Assurance labs and it has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as supported third-party integration in Cisco XDR.

Help update

The following update has been made to the Help:

• Added a note to the Secure Endpoint Configuration Insights Drawer section on the discrepancy between the total number of endpoints displayed in Cisco XDR and Secure Endpoint.

Judgments tab updates

The following updates have been made to the Judgments tab on the Intelligence page:

• The Delete judgment button in the Judgment Details drawer has been renamed to Delete.

• The disposition icons have been added to the observables displayed in the Judgments tab and the Judgment Details drawer.

• The Type column has been removed from the judgments table.

Help update

The following update has been made to the Help:

• Added new default targets for the Microsoft Government Community Cloud (GCC) integrations to the Targets Created From Integrations topic.

Help updates

The following updates have been made to the Help:

• Updated the View Summary of Device Details in Drawer section in the Devices topic to include the new panels.

• Updated screenshots in the Devices topic to align with the UI.

Help updates

The following updates have been made to the Help:

• Added Network Visibility Module - XDR regional API endpoints to the Create Deployment topic.

Notifications update

The Email toggle is now enabled by default for Automation Approval and Incident Assignment notification types when you configure the notification settings in the Settings tab on the Notifications page.

The following updates have been made to the Help:

• The Google Safe Browsing integration has been tested and certified by Cisco Quality Assurance labs and it has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as a supported third-party integration in Cisco XDR.

• Added the Crowdstrike Falcon Integration and API Void Integration topics to the Cisco XDR help. The links to the topics have been added to the table in the Cisco and Third-Party Integrations and Supported Capabilities topic.

Help update

Source has been removed from the Sort Incidents section in the Incidents topic.

Help updates

Various editorial updates have been made to all the topics in Intelligence, including consolidation of several topics.

Help updates

The following updates have been made to the Help:

• Added a detail about extended retention periods for workflow run data to the Runs topic.

• Added more details about using variable references in workflow activities to the JSONPath Query and Execute Python Script topics.

• Added a link to the Automation API Guide on DevNet to the Frequently Asked Questions topic.

Help updates

The following updates have been made to the Help:

• Added Minimum Cisco Security Risk Score to the Filters section in the Devices topic.

• Updated the View Summary of Device Details in Drawer section in the Devices topic to include a table with descriptions of the displayed fields.

• Updated the View Summary of User Details in Drawer section in the Users topic to include a table with descriptions of the displayed fields.

• Added the Device Overview and Vulnerabilities topics.

• Added Cisco Vulnerability Management to the Sources topic.

• Updated screenshots to align with the UI.

Help updates

The following updates have been made to the Help:

• Added Secure Endpoint groups and policies note to the Move to Deployment section of the Clients topic.

• Updated the Create Deployment topic for the new module enable toggles and create or upload profile options.

• Updated screenshots to align with the UI.

Notifications update

The Automation System Event notification type now includes Automation target updates.

Help updates

The following updates have been made to the Help:

• Updated tile to card in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• Updated the Asset Insights and Context column from No to Yes for the Cisco Vulnerability Management integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• Updated the Cisco Vulnerability Management Integration topic to include the new devices capability.

• Added the Secure Malware Analytics Integration topic to the Cisco XDR help. The link to the topic has been added to the table in the Cisco and Third-Party Integrations and Supported Capabilities topic.

Notifications update in ribbon

The Automation System Event notification type now includes Automation target updates.

Help updates

The following updates have been made to Help:

• Updated Default Tiles and Control Center topics with new screenshots to align with the UI.

• Moved the Secure Cloud Analytics section from Integration Tiles topic to the Default Tiles topic.

• Added section for new Secure Endpoint Configuration Insights feature.

Sources added to Incident drawer

The Sources panel has been added to the Incident drawer and it displays the sources or products that contributed events to the incident.

Relations graph enhancements in incident detail

Enhancements have been made to the relations graph to improve the directionality of the arrows on the graph and the highlighting of grouped nodes.

Help icons added to drawers

The (Help) icon has been added to the following drawers in Intelligence: judgments, indicators, events, and feeds. Click the (Help) icon in the lower left corner of a drawer to open the help topic for more information on the specific drawer.

Help updates

The following updates have been made to the Help:

• Added a note about the deprecation of this activity to the Create Approval Request topic.

• Added a note about the deprecation of this activity to the Wait For Event topic.

• Added a new topic for the Request Approval task activity.

Help updates

The following updates have been made to the Help:

• Added the Scroll Devices section to the Devices topic.

• Added the Scroll Users section to the Users topic.

• Removed deprecated Cyber Vision and Meraki integrations from the Sources topic.

• Updated the REST API Delta Sync column from No to Yes for the Cisco Secure Access integration in the Sources topic.

• Updated screenshots in the Devices and Users topics to align with the UI.

Help updates

The following updates have been made to the Help:

• Added the Scroll Devices section to the Clients topic.

• Updated screenshots in the Clients topic to align with the UI.

Mark all as read icon updated in Notifications popup

The (Mark all as read) icon has been updated in the Notifications popup when you click the (Notifications) icon in the upper right corner on the Cisco XDR header.

Meraki integration removed from Integrations page

The Meraki integration has been removed from the Integrations page and it has been replaced by the Cisco Meraki integration.

Help icon added to Pivot menu

The (Help) icon has been added to the Pivot menu. Click the (Help) icon in the lower left corner to open the help topic for more information on the Pivot menu.

MITRE ATT&CK^® Incidents tile update

To align with the MITRE ATT&CK^® framework ordering, the MITRE ATT&CK^® Incidents tile now displays all tactics, regardless whether they are reported by incidents over the selected timeframe. Previously, only tactics reported by incidents were displayed in the tile.

Help update

Updated the Detection Table Column Descriptions section in the Detection topic to align with the UI.

Help update

Updated screenshot in Events topic to align with the UI.

Improved health checks

Improved health checks have been added to ensure that Automation rules are executing as expected. Users are notified if rate limits are exceeded.

Help updates

The following updates have been made to the Help:

• Added Cisco Secure Access to the Sources topic.

Help updates

The following updates have been made to Help:

• Updated the Asset Insights and Context column from No to Yes for the Cisco Secure Access integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• Updated the Detection Analytics and Correlation column from No to Yes for the SentinelOne integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• Updated the Threat Hunting and Investigation column from No to Yes for the Splunk Cloud integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.

• Added the following topics to the Cisco XDR help: Cisco Secure Access Integration and SentinelOne Integration. The links to the topics have been added to the table in the Cisco and Third-Party Integrations and Supported Capabilities topic.

Help updates

Updated screenshots in the Default Tiles and Dashboards topics to align with the UI.

Created date update

The Created date in the incidents list and incident drawer now displays the date and time the incident was created, instead of the relative amount of time from the date and time the incident was created.

Help update

The following update has been made to the Help:

• Added a link to the Automation API Guide to the About Automation topic.

Help updates

Fixed an incorrect APJC regional API endpoint in the Create Deployment topic.

Help updates

Added the following topics to the Cisco XDR help: Orbital Integration, Zendesk Integration, Cisco Defense Orchestrator Integration, Cisco Duo Integration, Secure Email Appliance Integration, Secure Email and Web Manager Integration, and Secure Web Appliance Integration. The links to the topics have been added to the table in the Cisco and Third-Party Integrations and Supported Capabilities topic.

Help updates

The Change Incident Status and Filter Incidents sections have been updated in the Incidents App topic due to the new incident statuses.