Previous Release Notes for Cisco XDR in 2026

Instant Attack Verification and Attack Storyboard

Instant Attack Verification and Attack Storyboard are now available to all users in Cisco XDR, providing an automated, AI-driven analysis of security incidents. The Attack Storyboard is now the default view when you click View Incident Detail in the incident drawer, if applicable. For any incidents that do not support the new incident view with AI analysis, the classic incident detail view is displayed instead.

The incident detail with AI analysis view may take time to load. While the view is loading, you can click Classic view to open the incident detail in the classic view. When the AI analysis view is ready, a message is displayed and you can click Launch AI analysis view to open the incident detail with AI analysis. The incident detail view presents an overview of the AI analysis and evaluation of the incident, indicating whether it is likely a true or false positive threat. The AI in Instant Attack Verification assesses incidents in a manner similar to a human analyst, systematically forming and validating hypotheses. It analyzes individual detections, observables, indicators, and their combination, to identify a threat narrative consistent with the incident data. The final classification, along with reasoning, supporting evidence, and recommended response steps, is displayed in the incident detail view.

Number of unavailable incidents added to Detections page

The number of unavailable incidents that were previously part of a detection has been added to the Related incidents column on the Detections page. This occurs if an incident has been removed after its retention period or deleted by a user.

Incident detail with AI analysis updates

The following updates have been made to the incident detail with AI analysis page:

• Updated the attack graph to clearly reflect the summary in the Analysis panel. by emphasizing key entities and relationships identified through AI analysis, improving relationship labels, and presenting a concise incident narrative.

• Lessons learned phase, and Device Analysis, User Analysis, and Detection Analysis tasks in the Identification phase have been removed from the Response tab to streamline and optimize the view.

• Added the new Detection tab that displays the detection groups related to the incidents. The View detections link has also been added to the Evidence panel to open the Detections tab and the Detections panel has been removed from the Analysis panel.

• You can now click any observable to open an observable drawer for more information on the observable, such as an AI analysis summary and a list of related detections.

  Note: The AI analysis for observables is not available for incidents that were created prior to July 22nd, 2026.

• The Recommendations panel has been renamed to Containment and it displays critical playbook tasks from the Containment phase only. The Containment panel is only displayed if the incident classification is Decisive True Positive or Likely True Positive and a minimum of one observable that requires a containment action. The previous Identification, Eradication, and Recovery phases have been removed. You can continue to view them in the Response tab.

• The View details link in the Detections panel under the Analysis panel now opens the detection group drawer.

• Incident ID has been added to the header in the incident detail with AI analysis view. It displays the unique short identification number, with an INC prefix, to reference the incident.

Incidents from legacy Cisco Talos and Cisco Umbrella integrations

Cisco XDR no longer generates incidents from the Cisco Umbrella integration or from Cisco Talos Advisory Blog detections received through the Cisco Talos integration. These legacy sources do not align with the Cisco XDR incident creation methodology.

AI classification added to Incidents page and drawer

The new AI classification column has been added to the Incidents page. It displays the incident classification and confidence tags assigned by agentic AI based on its analysis of compromised or suspicious devices, user behavior and activities, and individual detections and their classifications. The confidence tag indicates the overall confidence of the incident classification (High confidence, Medium confidence, or Low confidence).

The AI classification tag has also been added to the incident drawer.

Cisco Vulnerability Management (CVM) End-of-Life

Existing targets that use the Cisco Vulnerability Management (CVM) integration will be shown as deprecated. Workflow runs that use this integration will list the Status as Fail in the workflows list.

Updated webhook API key security

When you create or regenerate a webhook API key, you can view and copy it only before leaving the page. Store the key securely; when you return, the key is masked in the webhook details and request examples. If you did not save the key, regenerate it to obtain a new one.

Duplicate devices filter

A Duplicate devices filter has been added to help users find potential duplicate devices. The Devices chart also shows the duplicate device count.

Manual device deletion

Administrators can now delete devices on the Devices page. Click Delete in the bulk action bar to delete selected devices. A maximum of 15 devices can be deleted at one time.

Remove device source

Administrators can now delete a source from a device on the Device Details page. Click Remove source in the source details drawer to remove the data from the device.

Endpoint Data Loss Prevention module

The Endpoint Data Loss Prevention module is now supported for macOS arm64 deployments.

Cisco Vulnerability Management integration removed from Integrations page

The Cisco Vulnerability Management integration has been removed from the Integrations page due to the End-of-Life announcement. For more information, see End-of-Sale and End-of-Life Announcement for the Cisco Vulnerability Management, Vulnerability Intelligence, and Application Security Module (formerly known as Kenna.VM, Kenna.VI, and AppSec).

Asset Isolation

Asset Isolation is now available in XDR Forensics. Asset Isolation enables you to completely isolate an asset from all network communication except its connection to the XDR Forensics Console, Cisco XDR, and Secure Client. This allows your investigation to proceed with full XDR Forensics capabilities while preventing threat actors from accessing the asset or external parties from interfering with the investigation.

Expanded macOS artifact coverage

XDR Forensics now expands KnowledgeC collection coverage with additional macOS activity streams, including application focus, web usage, lock and power state indicators, audio output, media activity, and modern activity streams. Analysts gain broader context when reconstructing user activity during security investigations.

View worklog link added to Reasoning panel in incident detail with AI analysis

Click the new View worklog link in the upper right corner of the Reasoning panel on the incident detail with AI analysis page to open the Worklog tab in the right pane, where the complete log of steps taken by agentic AI that led to the reasoning is available under AI Analysis.

CSV downloads for Devices and Users pages

CSV downloads now continue in the background for the Devices and Users pages. Cisco XDR sends a notification when the file is ready, so downloads are not interrupted if the UI session expires or the page refreshes.

CSV downloads for Clients page

CSV downloads now continue in the background for the Clients page. Cisco XDR sends a notification when the file is ready, so downloads are not interrupted if the UI session expires or the page refreshes.

Duo Desktop module for deployments

The Duo Desktop module is now available for Client Management deployments. Duo Desktop enables device health and security posture checks at authentication, device-bound authentication without a secondary device, proximity verification with Duo Mobile, and reduced MFA prompts throughout the day with Duo Passport.

Expanded Windows event collection coverage

Updated acquisition profiles to collect additional relevant Windows Event IDs. This gives you more visibility into activity that can support security investigations and retrospective analysis.

Improved interACT file download experience

InterACT command result downloads now include file size information. This enables progress indicators for larger downloads and improves the experience.

Incident detail with AI analysis updates

The following updates have been made to the incident detail with AI analysis page:

• The Event Timeline panel has been removed from the left pane on the incident detail with AI analysis page to streamline and optimize the view. The Back, Forward, and Back to start icons have also been removed from the bottom of the attack graph in the right pane.

• The Summary panel has been renamed to Analysis, and the Reasoning and Evidence panels have been moved from Summary to the left pane.

• The Analysis panel has been renamed to Assets in the left pane.

Date range filter update on Incidents page

The date range drop-down list at the top of the Incidents page now filters the incidents list based on the last activity date, instead of the created date. The Date range drop-down list in the Filters drawer also has been updated to Last activity.

Devices and Users page selection controls

The header row check box now selects all devices or users on the table page. Click Select all on the bulk action bar to select all the devices or users in the entire table.

OS version information tooltip

Added an information tooltip to the Operating system field in the Device Details drawer on the Devices page and the Device Details page. The tooltip explains that Windows 10, Windows 11, and Windows Server share the same base NT version (10.0.x), so a Windows 11 host may report a version beginning with 10.

OS version information tooltip

Added an information tooltip to the Operating system field in the Device Details drawer on the Clients page and the Device Details page. The tooltip explains that Windows 10, Windows 11, and Windows Server share the same base NT version (10.0.x), so a Windows 11 host may report a version beginning with 10.

Notification updates

The new XDR System Event notification type has been added to the Notifications page and the Notifications popup. It is triggered when there are system status updates that may impact service, or when a system task requires your attention or has been completed.

Windows Clipboard History artifacts

Added Windows Clipboard History and Clipboard Activity evidence sources to Investigation Hub. Analysts can review copied text activity and correlate clipboard-related evidence with other case data during Windows asset investigations.

Evidence repository options

Added support for S3-compatible evidence repositories and custom Azure Blob Storage domains. Administrators can use improved filtering, sorting, and last-used details to manage evidence storage across restricted, hybrid, or multi-organization environments.

Export controls

Updated export workflows with configurable CSV delimiters, UTF-8 BOM support, timezone options for Investigation Hub flag exports, and column-selection-aware exports. Analysts can generate cleaner files for reporting, correlation, and downstream analysis.

Investigator Toolbox from evidence details

Added Investigator Toolbox entry points to evidence detail views. Analysts can open selected field values directly from the evidence context without copying values into external tools.

Configurable audit logging

Administrators can now control which audit events are written to the Audit Log. This helps reduce noise, focus on high-value security events, and support compliance-driven monitoring requirements.

Incident ID added to the Incidents page

The new ID column on the Incidents page now displays the unique short identification number, with an INC prefix, to reference the incident. The number is only unique within the current organization. You can search or sort by ID number. The ID is also displayed in the incident drawer and the incident detail header.

Note: The ID is not available for incidents that were created prior to March 4th, 2026.

Last Activity column added to Incidents page

The new Last Activity column has been added to the Incidents page. It displays the date and time the current incident was updated by the system based on new or updated detections. The Last Activity is also displayed in the incident drawer.

Modified column renamed to Last Updated on Incidents page

The Modified column has been renamed to Last updated on the Incidents page. The column is optional and can be selected in the Table Settings drawer.

Investigated events in Detection tab

Investigated events are no longer generated for incidents and will not appear for new incidents in the Detection tab on the Incident Detail page.

Incident detail with AI analysis updates

The following updates have been made to the incident detail with AI analysis page:

• The View support details link in the upper right corner has been moved to the new (Options) icon as a Support details menu option next to the incident name.

• The Return to classic view button in the upper right corner has been renamed to Classic view.

• The Impact panel has been removed from the left pane and the Information icon that opens a confidence factors popup next to the confidence tags have been removed to streamline and optimize the view.

• Any feedback provided by users on the accuracy of the AI analysis for the incident is now displayed in the Worklog tab in incident detail and incident detail with AI analysis.

AI Run Summary

You can now generate an AI summary for completed workflow runs, helping you quickly understand workflow results without reviewing every action in detail. The run summary is available from the run drawer and supports workflow runs that include sub-workflows or atomic workflows.

In the run view drawer, click Generate Run Summary, when completed the summary is available within the drawer.

Linux deployments

You can now create Linux amd64 and arm64 deployments. To get started, click Create New on the Deployments page. We currently support RHEL, SUSE Linux Enterprise, and Ubuntu Linux distributions, and when downloading a Linux deployment installer, you will select the distribution endpoint version to download, such as RHEL 8. For a list of the supported modules for Linux deployments, see Operating System and Architecture Support.

Endpoint Visibility Module version update

Endpoint Visibility Module version 1.7 has been released. This release enhances threat visibility with OCSF 1.8 support, HTTP activity monitoring, API import reporting, and MITRE ATT&CK annotations for persistence. Performance improvements include optimized CPU and file IO, expanded DNS record collection, intelligent event aggregation, and restored Windows script execution visibility.

Controlled MITRE ATT&CK Analyzer database update management

XDR Forensics now supports versioned MITRE ATT&CK database delivery, release notes, manual version selection per asset, automatic update settings, and responder-side update tasks for more consistent Hunt/Triage activity.

Investigation toolbox

Investigation Hub now includes a floating, draggable, resizable toolbox with purpose-built analysis tools. It auto-detects common input types and routes analysts to the most relevant action.

Incident detail with AI analysis updates

The following updates have been made to the incident detail with AI analysis page:

• You can now provide feedback on the accuracy of the AI analysis of the incident by clicking the new Provide feedback in the incident detail header. Your feedback helps us expand the knowledge base used by our AI agents to improve incident analysis, classification, and response. The Additional info text box is also displayed when you change the incident status to any of the Closed statuses.

• The Related Detection Findings section has been renamed to Related Detections in the Detection Analysis Details pane, the Reference Detections section has been renamed to Detection Groups in the Asset Analysis Details pane, the Activity logs section has been renamed to Activities on the detection details page, and the Finding identification details section has been renamed to Detection identification details on the detection details page.

• The Lessons Learned phase has been added after the Recovery phase in the Response tab. It displays tasks that improve the incident response process for future incidents and overall security posture.

The following updates have been made to the Cisco Managed Incident Playbook:

• The Analyze Indicators task and the Identify Affected Hosts task have been removed from the Identification phase.

• The Delete Email Messages task has been moved from the Eradication phase to the Recovery phase.

• The previous Contain Incident: Assets (Devices) task has been renamed to Contain Incident: Isolate Device Assets and the previous Contain Incident: Assets (Users) task has been renamed to Contain Incident: Disable User Assets in the Containment phase.

• The Contain Incident: Domains, Contain Incident: URLs, Contain Incident: IP Addresses, and Contain Incident: Block File Hashes tasks have been renamed to Contain Incident: Block Domains, Contain Incident: Block URLs, Contain Incident: Block IP Addresses, and Contain Incident: Block File Hashes in the Containment phase.

• Moved the Identify Vulnerabilities task to the Eradication phase.

• Added the following tasks to the Recovery phase: Restore Contained Domains, Restore Contained IP Addresses, Restore Contained URLs, and Restore File Hashes.

The Detections page has been added to the Incidents left navigation menu. It was moved from the previous Detection Findings tab on the Investigate page has been moved to Incidents as a page and it has been renamed to Detections.

Detection Details page added to Detections page

You can now click View details in the detection drawer on the Detections page to open the detection details page. It displays detection details, such as description, MITRE ATT&CK tactics and techniques used by the detection, and activities as supporting evidence for the detection.

New Activities page added to Investigate

The new Activities page has been added to Investigate in the left navigation menu. The Activities page displays network activities from your environment. The current release supports only network activities from your Cisco Secure Client Network Visibility Module (NVM) if the XDR Default Deployment is installed on your endpoints. The normalized activity data are analyzed by Cisco XDR to generate Cisco XDR detections; these detections are then analyzed by the detection engine and may be correlated into incidents.

Detection settings page

The new Detection Settings page allows you to enable or disable specific detections to manage which events are included in Cisco XDR incident correlation. Additionally, you can view detailed descriptions and associated MITRE ATT&CK tactics and techniques for each detection.

You can now view and configure detections for Cisco Network Visibility Module (NVM) telemetry on the new Detection Settings page in Administration, with support for more telemetry sources planned for future releases. NVM alerts from Secure Cloud Analytics are being migrated to the Detection Settings page and require the XDR Default Deployment to be installed on your endpoints. As part of the transition from Secure Cloud Analytics, some NVM detections have been renamed or deprecated. For more information, see the Network Visibility Module Detection Migration Guide.

Note: As the NVM detections are migrated from Secure Cloud Analytics to Cisco XDR, the Detection Settings page may appear empty.

Data retention alignment

XDR Forensics Case data retention is now aligned with your Cisco XDR entitlement.

Structured Data Viewer for JSON, XML, and YAML

The Investigation Hub now includes a read-only structured data viewer supporting JSON, XML, and YAML, improving readability and forensic-level clarity on parsed artifact sources without external extraction. Enhancements in user visibility provide sortable "Created" and "Last Active" fields to help track authentication and active use for audit and compliance purposes. Syslog forwarding configuration applies dynamically, ensuring uninterrupted log integration during active investigations.

Incident detail with AI analysis updates

The following updates have been made to the incident detail with AI analysis page:

• The Events Timeline panel has been updated to display events based on the incident investigation and analysis by agentic AI. The attack graph in the right pane reflects the updated events timeline, providing a detailed view of the events.

  Note: The events and attack graph are not available for incidents that were created prior to April 29th, 2026.

• The Incident response progress bar has been added to the top of the Recommendations panel. It indicates the number of tasks with a Complete status out of the total number of tasks.

• The priority tags in the Recommendations panel have been added to the Response tab.

• The AI-generated tasks are completed as part of the AI analysis and they are not displayed in the Recommendations panel. You can view the details of the tasks in the Response tab.

Requested by updates in Evidence tab

The Requested by column in the Evidence tab now displays the name of the user who requested the acquisition or remote shell session. It previously displayed the email of the user.

You can also filter the evidence list by the name of the user who requested the acquisition or remote shell session using the Requested by drop-down list at the top of the Evidence tab.

Incident correlation

Incident analysis and correlation now includes Cisco Meraki AMP and IDS engine events. To view incidents with Meraki data, go to Incidents, select an incident with Cisco Meraki as a source, and open the Incident Detail page. On the Detection tab, you will see events from Cisco Meraki.

Workflow Editor

The following updates have been made to the Workflow Editor:

• Integration target types are now available in the Target Type drop-down list.

• Selecting a target type now pre-filters the available choices in the Target drop-down list to relevant targets.

• When you select the Specify Target on Workflow Start option, you can now choose supported integrations to narrow down the available targets when running the workflow.

• When you select the Execute on This Target option, the target is now pre-selected if there is only one target available for the target type.

• The AI Agent activity can now use a pre-selected target for execution of workflows that have theSpecify on Workflow Start option selected.

Targets Page

You can now filter by integration target type when searching targets.

Cisco Meraki integration

The Cisco Meraki integration now ingests AMP engine events, and malware and indicator-compromise IDS engine events for incident correlation. Support for additional event types is planned for future releases.

XDR Forensics Knowledge Base

The XDR Forensics Knowledge Base has been migrated out of the PDF-based knowledge base to the web-based HTML Cisco XDR Help Center to improve the discoverability of technical resources and provide a more intuitive navigation experience.

AIR File Explorer XFS Partition Support

Added support for recognizing and parsing XFS partitions in disk images. Analysts can now browse and analyze evidence from XFS-based assets directly within AIR File Explorer.

Expanded Windows evidence coverage in Baseline Comparison

Comparison supports over 40 new Windows artifact sources, including file system, registry, system, network, and SRUM data, enabling deeper and broader comparative analysis.

Response tab update in incident detail

The Cisco Managed tasks that are automatically generated by AI based on the observables for the incident have been removed from the list of tasks in the Identification phase in the Response tab. You can view AI-generated recommended tasks in the Recommendations panel on the incident detail with AI analysis page, if applicable.

Incident detail with AI analysis updates

The following updates have been made to the incident detail with AI analysis page:

• The AI-generated recommended tasks (Device Analysis, User Analysis, and Detection Analysis) have been added to the Identification phase in the Recommendations panel and the Response tab. These tasks are based on the analysis of the detection findings, logs, and observables in the incident.

• The (Reset timeline) icon has been removed from the Summary panel. You can use the Attack Graph breadcrumb in the upper area of the right pane to reset the view to the attack graph.

• The previous View details icon has been replaced with the View details link in the Analysis panel.

• You can now view the number of recommended tasks out of the total number of tasks at the bottom of the Recommendations panel. Click the View all tasks in Response tab link to view all the tasks in the Response tab.

• The View more or View less links have been added to display or hide additional assets in the Analysis panel.

Action count badge added to Actions Taken in node drawer

If there are more than 50 actions taken, all identical actions will now be aggregated into one action with the action count displayed as a badge to the left of the source in the Actions Taken area of the node drawer.

Account Keys

For security reasons, HTTP targets with remote no longer support Cisco XDR Token as an account key. Pass an authentication header instead.

Automation Remote

Virtual appliances based on v2.x OVAs are deprecated. The state of connected v2.x Remotes are not impacted, but users should replace their virtual appliances with v3.0 or newer OVAs for continued support.

You can now set the validity period of certificates up to 2 years on remotes based on v3.0 or newer OVAs.

Unified device status fields

Fields on the Devices page have been updated to improve filtering and provide an easier way to view the different properties for devices. We've merged the data from previous fields and the following fields have been added:

• Management status - replaces the Managed and Supervised fields.

• Security status - replaces the Compromised, Tampered, Jail Broken, Isolated, and Has faults fields.

• Disk encryption - replaces the Encrypted field.

• Firewall status

• Antivirus details

• Device health status

• Compliance status - replaces the Compliant field.

Rules that included the deprecated fields will be disabled until you update the Rule Criteria. Click Rules on the Devices page to view which rules need to be updated.

Saved filters containing deprecated fields have been automatically updated to remove those fields. To include the updated status fields, you will need to create and save new filters.

Security and Compliance card

The Security Products card on the Device Details page has been expanded into the new Security and Compliance card. This card provides the previous fields for Firewall status and Disk encryption, while providing new fields for Device health, Antivirus details, and Compliance status if available.

Secure Endpoint source card

The Cisco Secure Endpoint (AMP) card on the Device Details page has been merged into the Secure Endpoint card in the Seen in Sources section. To see the AV definitions status, Device isolation status, Orbital enablement, and other device data provided by Secure Endpoint, click View full details on the source card.

New user fields

The following fields have been added to the Users page to enable you to evaluate user behavior, risk levels, and take more effective action during incident investigations:

• Level of trust

• Last updated level of trust

• Status

User details

The User Details page has been reorganized to display the Security and User Details sections. The Security section includes the user's trust level and additional information that was used to determine the user's Trust Level, and the user's multi-factor authentication status and a list of all the identity events from Identity Intelligence. The User Details section includes the identity details, used devices, activity details, and organization details for the user.

Enhanced remote shell session visibility

When reviewing historical remote shell (interACT) sessions, the session header now shows the specific task name, enabling analysts to quickly identify and navigate between concurrent live-response sessions. This improves investigation context and analyst efficiency.

Filter by evidence type added to Evidence tab in incident detail

You can now filter the evidence list by evidence type using the new Evidence type drop-down list in the Evidence tab.

Getting Started Page

View a Getting Started page the first time you navigate to Automate > Workspace.

Custom security event type

Added a new Identity security event type to Custom Security Event Workflow.

Help updates

Updated Automate documentation with current procedure to create workflows.

Commvault Cloud integration added to Integrations page

The new Commvault Cloud integration has been added to the Third-Party tab on the Integrations page. Integrating Commvault Cloud with Cisco XDR enhances network and data security and inter-operability. Organizations can initiate Commvault protection for VM workloads directly from the Cisco XDR platform, through the Automate functionality, preserving the VM’s current state early in incident response. SOC teams can also create Cleanroom Recovery Groups within Commvault, enabling impacted VMs to be restored into an isolated environment for investigation and, when appropriate, recovered back to production after the incident.

User role updates

XDR Forensics Org Admins have been promoted to the Global Admin user role. This will enable admins to have full control over managing 118 specific privileges, allowing the creation of highly customized user roles. This granular access control ensures that each user or group has permissions tailored to their specific needs, such as handling evidence acquisition, interACT sessions, or audit log management.

New incident detail view with AI analysis

You can now click Launch New Incident View in the upper right corner of the incident detail to display the new AI-powered incident detail view.

This view presents an overview of the AI analysis and evaluation of the incident, indicating whether it is likely a true or false positive threat. The AI assesses incidents in a manner similar to a human analyst, systematically forming and validating hypotheses. It analyzes individual detections, observables, indicators, and their combination, to identify a threat narrative consistent with the incident data. The final classification, along with reasoning, supporting evidence, and recommended response steps, is displayed in the incident detail view.

Note: The new incident detail view is currently in Beta and subject to change.

Activities

Added toggle to fill empty fields with default values in the Parse JSON activity.

Endpoint Visibility Module

The Endpoint Visibility Module is available for Windows amd64 and macOS deployments. The Endpoint Visibility Module is a critical component for organizations striving for seamless endpoint visibility and advanced threat detection within Cisco XDR. Its comprehensive endpoint telemetry complements Cisco and third-party EDR deployments, adding essential context to threat detections.

Endpoint Data Loss Prevention

The Endpoint Data Loss Prevention module is now available for Windows amd64 deployments. Cisco Endpoint Data Loss Prevention (Endpoint DLP) enables you to protect sensitive data on endpoints by controlling what data is transferred to external devices. It extends your organization’s data protection policies to the endpoint.

You can also upload a new Endpoint Data Loss Prevention profile to the Profiles page and select a Endpoint Data Loss Prevention profile when creating new deployments.

Advanced Time Display and Copy Options

The DateTime component within XDR Forensics now includes a contextual popover to view and copy timestamps in multiple formats including UTC, ISO, local, and relative time. This enhancement streamlines correlation activities across multiple evidence sources and logs during complex investigations.

Filter by data type added to Observables drawer

You can now filter the list of observables by data type using the new Type drop-down list at the top of the Observables drawer in the incident detail.

The total number of searched or filtered results is now displayed to the right of the Type drop-down list.

Evidence tab update

When you click the evidence name in the Evidence tab, it opens the evidence details directly in the XDR Forensics UI. You no longer need to click the View Investigation Hub icon on the XDR Forensics page before it opens the evidence details in the XDR Forensics UI.

Improved Endpoint Name Change Handling to Enhance System Performance

In certain environments, endpoint name change events could previously be triggered due to misconfigured deployments, particularly in cases involving golden image deployments that did not follow the provided deployment guidelines. This scenario could result in a high volume of asset name changes, generating excessive audit logs and triggering updates on investigations. The combination of frequent asset name updates, audit log generation, and related notifications created significant system load, leading to performance degradation.

In addition, audit log generation and event-based notifications related to endpoint name changes have been disabled, as their operational impact outweighed their functional value.

To improve overall system performance and protect core AIR functionality, endpoint name change handling on investigations and the related audit log generation have been removed, as their operational impact outweighed their functional value. Additionally, the warning status indicating a high number of endpoint name changes has been removed, as it relied on audit log data.

Improved Auto-Scaling and Recovery Stability for SaaS Tenants

Some SaaS tenants previously experienced extended auto-scaling and recovery durations due to a potential issue related to database connection handling during application startup.

Enhancements have been implemented to improve database connection management during startup, resulting in more stable auto-scaling behavior and reduced recovery times.

New statuses added to the Evidence tab

The following new statuses have been added to the Evidence tab in the incident detail:

• Partially complete - Parts of the forensic acquisition did not complete successfully due to insufficient disk space on the machine to complete the acquisition or drone failures. Hover over the status tag to display the reason.

• Expired - The forensic acquisition or remote shell session has timed out due to a lack of response from the endpoint for 7 days or more.

• Canceled - The forensic acquisition or remote shell session has been canceled in XDR Forensics.

Copy and Download buttons added to Intelligence page

The new Copy and Download buttons have been added to the JSON panel in the Judgments, Indicators, Events, and Feeds tabs on the Intelligence page.

AppOmni SaaS Security integration added to the Integrations page

The new AppOmni SaaS Security integration has been added to the Third-Party tab on the Integrations page. AppOmni enriches Cisco XDR investigations with SaaS identity, access, and threat context. Search AppOmni directly from Cisco XDR to understand who a user is, what SaaS applications they can access, and their level of access, including elevated or administrative privileges.

Historical data update in Pivot menu

The Historical button at the top of the Pivot menu has been renamed to Incident time or Investigation time, depending on whether the Pivot menu is opened in an incident or an investigation.

Smarter evidence analyzer behavior for missing artifacts

DRONE analyzer logic now skips analysis tasks when expected artifacts are absent from collected data. This prevents confusing error messages and makes error logs clearer and more accurate for investigation teams.

Investigation Hub asset filter crashes with large cases

The Asset drop-down list in Investigation Hub could become unresponsive in investigations with thousands of assets. The filter now supports virtualized loading for smoother performance in enterprise-scale environments.

Asset registration failure on identical cloud instance IDs

In environments where multiple assets share the same cloud infrastructure ID, responder registration could fail. XDR Forensics now handles additional identifiers to differentiate assets reliably in these cases.

Meraki adapter

Meraki adapter was superseded by Cisco Meraki integration in release 2.29. The current release removes the obsolete adapter.

Rules for users

You can now create rules that will assign labels and values to users automatically. On the Users page, click Rules to open the drawer to create new rules from search or from scratch.

Cisco Meraki Network Devices support

Meraki Network Devices are now supported on the Devices page, and the Sources page will display a separate cards for Meraki Network Devices. Existing customers do not need to update their Cisco Meraki integration, as the integration module will automatically ingest Meraki Network Devices data.

Device type chart

The device type chart on the Devices page now includes a check box for Other devices, which includes network devices and IoT devices. The Other check box will automatically filter the table for those device types. To filter by a specific type of network device, for example, Firewall devices, use the Type drop-down menu in the Filters drawer.

User management in Secure Cloud Control

The ability to invite users, change user status, and manage user permissions will be moved from the Manage Users page in Cisco XDR to the Administrator Access page in Security Cloud Control. For more information on inviting users and managing permissions in Security Cloud Control, see Managing Role-Based Access Control in the Cisco Security Cloud Control Administration Guide.

The Manage Users page will become view-only, displaying all users in your organization along with their assigned roles and current statuses.

This change goes into effect on January 28, 2026. If you are an existing Cisco XDR user, your account will be automatically migrated to Security Cloud Control on January 28th, 2026. Your tenant will need to be attached to your Security Cloud Control Enterprise to leverage this functionality. No additional action is required by your organization.