Previous Release Notes for Cisco XDR
2.32
Release Date: December 4, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Filters added to Actions Taken drawer |
The Source and Action filters have been added to the upper portion of the Actions Taken drawer. The filters allow you to narrow the list of all the actions taken and show only those actions that match the filters you have selected. |
Overview |
|
Partially complete playbook task status added to Response page |
The new Partially complete task status is displayed as a tag on the Response page if the workflow has been executed and completed but one or more actions may have failed. Click View run in the task drawer and view the workflow run details for more information. |
Response |
|
Incidents page updates |
The following updates have been made to the Incidents page:
|
|
|
AI-generated notes in response playbooks |
The Generate note button has been added to the non-executable tasks in an incident response playbook and it provides a convenient alternative to documenting your findings. When you click Generate note, a draft note is generated by Cisco AI and you can regenerate or modify the AI-generated note before you add it to the task. The content of the note is derived from the description of the task, title and description of the phase, and security events. |
|
|
Important only filter removed from Detection page |
The Important only check box and indicator in the Events table have been removed from the Detection page in incident details. |
(Filters) icon. The Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Filters added to Actions Taken drawer |
The Source and Action filters have been added to the upper portion of the Actions Taken drawer and the filters allow you to narrow the list of all the actions taken and show only those actions that match the filters you have selected. |
Intelligence
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
Updated the Create Private Judgment topic with a new screenshot of the Create Judgment dialog box to align with the UI. |
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Variable references |
Variable references in UI fields are now displayed as pills, making them shorter and easier to read. The length of text in each pill is reduced by generally concatenating the properties. Hover over a pill to display a tooltip showing its full path of breadcrumbs. For example: A pill that says “HTTP Request….First Name in Response Headers” shows “Activity > HTTP Request > Output > Response Headers > First > Name.” For a broken reference, the pill says “Reference not found” and the tooltip on hover shows the full, raw reference link with the underlying data. |
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Cisco Meraki integration support |
The Cisco Meraki integration is now supported as source for the Devices page. |
|
|
Help updates |
The following updates have been made to the Help:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Full disk access requirement for Network Visibility Module - XDR |
Secure Client version 5.1.7.x and later and macOS 10.14 and later require approval before an application can access parts of the file system that contain personal user data. Network Visibility Module - XDR will not be able to fetch the process details without this approval. You will need to enable Full Disk Access manually or using a Mobile Device Management (MDM) profile. |
|
|
Help updates |
The following updates have been made to the Help:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Notification type update |
The Unknown notification type has been added to notifications and it indicates that the type of notification is undefined. |
Notifications |
Integrations
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
2.31
Release Date: November 20, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Refresh tiles message added to Customize Dashboards |
A message has been added to the Customize Dashboards dialog box to remind users to click Refresh Tiles if a configured integration does not appear in the list of integrations. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Auto-assigned incident update |
If a user with an Administrator role navigates to the Incident Detail page for an incident that is Unassigned and has a status of New, the incident is no longer automatically assigned to the current user. Only users with an Incident Responder or Security Analyst role are automatically assigned. |
|
|
Cisco Managed Incident Playbook updates |
The following tasks in the Containment phase have been updated to include Cisco Secure Access as a supported integration in Automation workflow: Contain Incident: IP Addresses, Contain Incident: Domains, and Contain Incident: URLs. |
|
|
Actions Taken in attack graph and node drawer |
The |
(Actions Taken) icon on the node in the attack graph indicates that remedial actions have been executed by the integrated Endpoint Detection and Response (EDR) system for the device. In the node drawer, the Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Actions Taken in relations graph and node drawer |
The |
|
|
Help updates |
Updated the Events and Saved Investigations topics with new screenshots to align with the UI. |
Intelligence
No new customer-facing features or updates in this release.
Automate
No new customer-facing features or updates in this release.
Assets
No new customer-facing features or updates in this release.
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
Added a note to the Clients topic with the maximum number of devices you can move between deployments at one time. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Notifications added to Capabilities filter on Integrations page |
The Notifications capability has been added to the Capabilities drop-down list on the Integrations page. |
— |
| Notification settings update |
The Integrations page link has been added to the upper portion of the Settings tab on the Notifications page and it opens the Integrations page in a new tab with the Notifications capability filter applied. |
Notifications |
Integrations
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
2.30
Release Date: November 6, 2024
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
Updated the Getting Started topic with a new screenshot in the Sign In to Cisco XDR section to align with the UI. |
Getting Started
|
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Map view added to Top IP Addresses tile for Secure Malware Analytics integration |
A new map view has been added to the Top IP Addresses tile for the Secure Malware Analytics integration. To display a map view of the top IP addresses referenced during analysis, click the You can zoom in and out to increase or decrease the view of the map and you can click the markers on the map to view the IP address details. |
— |
|
Detection Ingest Status tile added to dashboards |
The new Detection Ingest Status tile for the Secure Cloud Analytics integration has been added to the list of available tiles in the Customize Dashboards dialog box. The tile displays the last ingested time and the last verified time for each integrated detection source. |
|
|
Help update |
Updated the list of tiles for the Cisco Secure Access integration in the Integration Tiles topic. |
(Map View) icon in the upper right corner of the Top IP Addresses tile or click the 
(Ellipsis) icon and choose Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Fail to load attack graph message in incident details |
A message is now displayed if the attack graph in the Overview tab has reached the maximum load limit and it cannot be displayed. You can continue to access other incident details. |
|
|
Cisco Managed Incident Playbook updates |
The following updates have been made to the Cisco Managed Incident Playbook:
|
|
|
Property condition update in playbook assignment rule |
You can now search for a specific property when you click the Property drop-down list in the playbook assignment rule drawer. |
|
|
Help update |
Updated the Incidents topic to include file hashes as one of the common indicators in the description. |
Incidents |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Errors and/or warnings added to Investigation Results page |
The Investigation Results page now displays an error and/or warning badge if an error and/or warning occurred during a new investigation. Click the badge to view a detailed list of errors or warnings. Once the investigation is saved, the error and/or warning badge changes to Historical errors and you can click the badge for a list of errors and/or warnings that occurred at the time of the investigation. |
|
|
Help updates |
Added the Person icon, updated the list of icons, and removed the Category column from the table in the Graph Icon Descriptions topic. |
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Legacy triggers superseded by Automation Rules |
Legacy triggers in Automation were deprecated and have now been permanently removed from Cisco XDR. This will lead to the removal of both the Events and Schedules tabs. This change was implemented to streamline the platform and ensure that all users benefit from the enhanced capabilities and improved performance of our newer functionality, Automation Rules. Automation Rules offers a comprehensive and flexible replacement solution for defining when your workflows are executed, including following schedules and specific events. This feature allows you to add optional conditions, ensuring that workflows are executed only when the criteria you specify are met. Examples of events that can trigger automation rules to execute workflows include:
|
|
|
Help updates |
The following updates have been made to the Help:
|
Assets
No new customer-facing features or updates in this release.
Client Management
No new customer-facing features or updates in this release.
Administration
No new customer-facing features or updates in this release.
Integrations
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Integration walkthrough video added to Crowdstrike integration |
The new Integration Walkthrough area has been added to the Crowdstrike integration page. Click Try a demo in the Integration Walkthrough area to open a guided tour of how to integrate Crowdstrike with Cisco XDR. |
— |
|
Palo Alto Networks Cloud integration update |
The Palo Alto Networks Firewalls with Cortex Logging application in the Palo Alto Networks Cortex Cloud integration has been renamed to Palo Alto Networks Firewalls with Strata Logging Service. |
Cisco and Third-Party Integrations and Supported Capabilities
|
|
Secure Network Analytics integration update |
Secure Network Analytics v7.5.1 can now be configured using the Secure Network Analytics module on the Integrations page. Enabling this integration sends Secure Network Analytics alarm events to Cisco XDR for correlation with other events, allows Cisco XDR to request top security events from Secure Network Analytics to enrich the investigation context in Cisco XDR, and provides tiles on the Cisco XDR dashboards to monitor key operational metrics. For more information, see the Secure Network Analytics and Cisco XDR Integration Guide 7.5.1. |
Cisco and Third-Party Integrations and Supported Capabilities Secure Network Analytics Integration
|
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
No new customer-facing features or updates in this release.
2.29
Release Date: October 23, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Adversary Filters added to the MITRE ATT&CK Coverage Map page |
You can now filter the MITRE ATT&CK coverage map by adversaries and threat groups. For more information, see MITRE ATT&CK Groups. Filtering by adversaries allows you to view the techniques used by the adversary groups and whether the selected products protect you against the techniques used by the adversary groups. |
|
|
Cisco Secure Access tiles added to Customize Dashboards |
The new Cisco Secure Access integration has been added to the list of available dashboard tiles in the Customize Dashboards dialog box . |
|
|
Help update |
Updated the Default Tiles topic with new screenshot in the High Impact Incidents section to align with the UI. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Incident priority score calculation update to improve accuracy |
The formula to calculate the priority score for incidents has been updated to improve the way tactics, techniques, and procedures (TTPs) are factored into the overall incident priority score, providing a more accurate reflection of the priority of the incidents that require response actions. Only new incidents generated after the 2.29 (October 23rd, 2024) release will use the new priority score calculation. This may cause new incidents to be scored lower than the previous incidents and new incidents may appear below previous incidents in the incidents list on the Incidents page. |
|
|
Not applicable status update in response playbooks |
The Not applicable task status is now automatically set for response playbook tasks that require certain observable types for task execution, but no observables of that type exist in the incident. This will cause the task to be hidden when viewing the response playbook if the Hide not applicable tasks toggle is on. |
Response |
|
Contain Incident: Quarantine Email Messages task for playbook |
The new Contain Incident: Quarantine Email Messages task has been added to the Containment phase in the Cisco Managed Incident Playbook. This task contains email messages to stop the spread of malicious activity. |
|
|
New incident generation framework |
We are now using a new framework for generating incidents directly within Cisco XDR, instead of promoting incidents and attack chains from Secure Cloud Analytics. This new framework enables:
Incidents created from attack chains prior to 2.29 will remain open until manually closed, but the incidents will no longer receive updates. |
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Access to select ITSM products has been expanded to all Cisco XDR licensing tiers |
Now expanded to also include the Cisco XDR Essentials licensing tier, you can see the ITSM integration targets created by the system and choose which to use in your Automation workflows. For details, see the new Minimum Cisco XDR Licensing Tier Required column added to the Cisco and Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Help update |
The following update has been made to the Help:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
ServiceNow integration support |
The ServiceNow integration is now supported as source for the Devices page. |
|
|
Help updates |
The following updates have been made to the Help:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
Updated the pre-deployment installation support note in the Deployment Management topic. |
Administration
No new customer-facing features or updates in this release.
Integrations
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Select third-party integrations available to Cisco XDR Essentials licensing tier |
The Cisco XDR Essentials licensing tier now includes threat intelligence and IT Service Management (ITSM) third-party integrations that previously required the Cisco XDR Advantage or Cisco XDR Premier licensing tier. For details, see the new Minimum Cisco XDR Licensing Tier Required column added to the Cisco and Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Cisco Secure Access integration added to the Cisco tab on Integrations page |
The new Cisco Secure Access integration has been added to the Cisco tab on the Integrations page. Cisco Secure Access automatically uncovers attacker infrastructure staged for current and emerging threats and proactively blocks malicious requests before they reach a customer’s network or endpoints. With integration, customers can stop phishing and malware infections earlier, identify already-infected devices faster, and prevent data exfiltration. The integration provides complete visibility into Internet activity across all locations and users. Multiple Cisco Secure Access functions are supported and linked via the API key that has been generated in the Cisco Secure Access Platform. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Ivanti Neurons integration update on the Integrations page |
The Ivanti Neurons integration has been renamed to Ivanti Neurons for MDM. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Cisco Meraki integration added to the Cisco tab on Integrations page |
The Cisco Meraki integration has been added to the Cisco tab on the Integrations page. The Enable button on the Cisco Meraki integration card allows you to enable the integration with Cisco XDR in Meraki. Once enabled, it is automatically integrated in Cisco XDR and the Cisco Meraki integration is displayed in the My Integrations area. The Cisco Meraki integration provides cloud-managed IT solutions, from networking appliances to endpoint management. Cisco XDR ingests IPFIX netflow records and meta data, including organization, network, and node serial number from Cisco Meraki. This data is then used for detection analytics and correlation to create incidents. For more information, see the XDR article in the Meraki documentation. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Help updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Incident app and XDR icons updated in ribbon |
The Incident App and the XDR icons have been updated throughout ribbon. |
Resources
No new customer-facing features or updates in this release.
2.28
Release Date: October 9, 2024
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
Updated the Getting Started topic with a new screenshot in the Sign In to Cisco XDR section to align with the UI. |
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Risk score filter added to MITRE ATT&CK Coverage Map page |
The risk score filter has been added to the Product Coverages area, allowing you to filter the coverage map by the severity of the risk score. |
|
|
Help updates |
Updated the Control Center and Dashboards topics with new screenshots to align with the UI. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Cisco Managed Incident Playbook updates |
The following updates have been made to the Contain Incident: IP task in the Containment phase:
|
|
|
Incident search update |
The search functionality on the Incidents page no longer supports Lucene Query Syntax. |
|
|
Incident correlation and analytics support for Microsoft Defender for Office 365 application in Microsoft Cloud integration |
The security detections from the Microsoft Defender for Office 365 application are now included in incident correlation and analytics in Cisco XDR. |
— |
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Targets page GitHub Repositories page |
Both the Targets page and GitHub Repositories page have been enhanced to display paginated results. Now you can choose how many rows can be displayed on each page of the table and navigate through multiple pages. |
|
|
Rate limits |
To preserve system resources and ensure the integrity and performance of the platform, Automation rate limits have been updated. Please refer to the respective Help topics to the right. |
Workflow Best Practices - Overall Workflows - Important Notes and Limits Automation Rules - Thresholds and Limits |
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
User values |
You can now assign values to users on the Users page. You can manually assign a value from 1-10, where 1 is the least critical and 10 is the most critical. The default value is 10. |
|
|
User labels |
You can now assign labels to users on the Users page. Use the Labels drawer to manage the labels that can be assigned to users. |
|
|
Help updates |
The following updates have been made to the Help:
|
Client Management
No new customer-facing features or updates in this release.
Administration
No new customer-facing features or updates in this release.
Integrations
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Darktrace DETECT & RESPOND integration update on the Integrations page |
The Darktrace DETECT & RESPOND integration has been renamed to Darktrace /NETWORK. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Incident correlation and analytics support for Microsoft Defender for Office 365 application in Microsoft Cloud integration |
The security detections from the Microsoft Defender for Office 365 application are now included in incident correlation and analytics in Cisco XDR. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Help updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
No new customer-facing features or updates in this release.
2.27
Release Date: September 25, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Tooltip added to product badge on MITRE ATT&CK Coverage Map page |
You can now hover over the product badges on the technique cards to display the products that are selected and covered by the technique in a tooltip. |
|
|
Incident Promotion Reason tile removed from dashboards |
The Incident Promotion Reason tile for the Secure Firewall integration has been removed from the list of available tiles in the Customize Dashboards dialog box. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help icons added to drawers |
The |
|
|
Playbook task status updates on Response page |
The previous Errored task status on the Response page has been updated to Workflow failed and one of the following task statuses is now displayed to provide more information on the workflow data when a network error occurs: Failed to load Assets, Failed to load Observables, or Failed to load Assets and Observables. |
|
|
Close and Export Incident task for playbook |
The new Close and Export Incident task has been added to the Recovery phase in the Cisco Managed Incident Playbook. This task performs incident closure and incident summary data retention in an external system. |
Response |
|
Cisco Managed Incident Playbook updates |
The following tasks have been updated to include Microsoft Entra ID as a supported integration in Automation workflow:
|
Response |
(Help) icon has been added to the following drawers in incidents: incident details, assets, observables, indicators, event, workflow run, and task. Click the Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
View summary of child workflow while editing its parent workflow |
When working on a parent workflow in the Workflow Editor, now you can click the |
|
|
Choose and display integration logo on workflow card in Exchange |
Now you can select integrations from a drop-down list when requesting your workflow be published to Exchange. Choose the primary integration and its logo will be displayed on the workflow card in Exchange. |
|
|
Target selection when integration supports multiple targets |
During the import of a workflow or installation of a workflow from Exchange, if an integration (for ex. PagerDuty) supports more than one target, the configuration wizard automatically chooses the valid target to use that was assigned during the export or publishing of the workflow. This enhancement provides guidance when it is not known which one of the multiple targets to use. You'll also see the chosen target in the properties of the workflow in the Workflow Editor. |
|
|
Help updates |
The following help topic has been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
| Feature | Description | Help Topic |
|---|---|---|
|
Network Visibility Module |
The Network Visibility Cloud Module has been renamed to Network Visibility Module - XDR on the Create Deployment page. |
Create Deployment |
|
Help update |
The following help topic has been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
| Notification type updates |
The following updates have been made to the Notifications page:
|
Notifications |
|
Help updates |
Updated the screenshots in the Users and My Account topics to align with the UI. |
Integrations
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities Attack Surface Management Integration Cisco Vulnerability Management Integration |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
No new customer-facing features or updates in this release.
2.26
Release Date: September 11, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
MITRE ATT&CK Coverage Map updates |
The following updates have been made to the MITRE ATT&CK® Coverage Map page:
|
|
|
Help updates |
The following updates have been made to the Help:
|
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Timeline panel update in attack graph |
The Timeline icon has been updated to Show timeline or Hide timeline in the Timeline button. |
|
|
Communicated With added to attack graph and Relations panel |
The following new relations type has been added to the attack graph on the Overview page and the Relations panel in the Event drawer on the Detection page: Communicated With. The Communicated With relations type indicates that the direction of the communication between nodes is unknown. |
|
|
Domain indicator of compromise added to observables for Crowdstrike integration |
The domain indicator of compromise has been added to the observables in the Event drawer on the Detection page for the Crowdstrike integration, if available. |
— |
|
Help updates |
Updated the Incident Detail and Overview topics with updated screenshots to align with the UI. |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Timeline panel update in relations graph |
The Timeline icon has been updated to Show timeline or Hide timeline in the Timeline button. |
|
|
Help updates |
Updated the Investigation Results and Timeline topics with updated screenshots to align with the UI. |
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
History log of automation rule triggers |
Now you can see the events that occurred and triggered your automation rules during the past 72 hours. Navigate to the Automate > Triggers page and click the History tab. Click an event to open its drawer and view additional details, including raw event data and links to the rules that were matched and the workflows that were executed. |
|
|
Support for Markdown in string input variables, activities, and atomics |
For variables with a string as the data type, now there’s a new field in the General configuration section called String type. From the String type drop-down list, now you can choose HTML, JSON, Markdown, text, Python, XML, or YAML. And in accordance with the type of string you choose, an editor is opened for you to enter the value in that respective format. |
|
|
Support for Python code in the Python activity |
Now you can enter, edit, and preview Python code in the properties of the Python activity when you're updating it in the Workflow Editor. |
|
|
Help updates |
The following help topics have been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Notification updates |
The following updates have been made to the Notifications page:
|
Integrations
| Feature | Description | Help Topic |
|---|---|---|
|
New Palo Alto Networks Cortex Cloud integration added to Integrations page |
The new Palo Alto Networks Cortex Cloud integration is now available in the Third-Party tab on the Integrations page. This new integration allows you to manage and maintain one set of Palo Alto Networks Cortex credentials across multiple product integrations between Cisco XDR and Palo Alto Networks Cortex products. The existing Palo Alto Networks Cortex XDR integration has been removed from the Integrations page and it has been added to the Palo Alto Networks Cortex Cloud integration as an application. To add a new Palo Alto Networks Cortex XDR integration, you must first add a Palo Alto Networks Cortex Cloud integration. You will then be able to configure the Palo Alto Networks Cortex XDR application in Palo Alto Networks Cortex Cloud to use the same cloud credentials. Future integrations of other Palo Alto Networks Cortex cloud-driven applications can then be configured via the same Palo Alto Networks Cortex Cloud integration to use those shared credentials. If you have an existing Palo Alto Networks Cortex XDR integration configured, it is automatically migrated to the new Palo Alto Networks Cortex Cloud integration. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
New Palo Alto Networks Firewalls with Cortex Logging application added to Palo Alto Networks Cortex Cloud integration |
The new Palo Alto Networks Firewalls with Cortex Logging application has been added to the new Palo Alto Networks Cortex Cloud integration in the Third-Party tab on the Integrations page. Palo Alto Networks Next-Generation Firewalls (NGFW) provide advanced and integrated security features beyond traditional firewalls. These features include application awareness, URL filtering, content inspection, and threat prevention capabilities. Forwarding NGFW logs to Cortex XDR, where they are normalized and enriched with endpoint and cloud data from various products, enables the ability to query NGFW alerts via the Cortex API. Leveraging Palo Alto Networks NGFW alerts allows you to query security detections for observables such as IP addresses, URLs, file names, MD5 hashes, SHA-256 hashes, emails, and email subjects. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Help updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
No new customer-facing features or updates in this release.
2.25
Release Date: August 28, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Unassigned Incidents tile update |
The Severity column has been replaced by a new Priority column for the Unassigned Incidents tile. The Priority column displays a color-coded based priority score assigned to the incidents. |
|
|
Risk scores added to MITRE ATT&CK® Coverage Map |
The risk scores have been added to the technique cards and the tactic and technique drawers on the MITRE ATT&CK® Coverage Map page. Risk scores indicate the probability of financial impact if the MITRE ATT&CK patterns are not mitigated and they are the detection risk used to calculate the priority score for incidents. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Preview added to Add Note on Response page |
The Preview tab has been added to the Add Note text editor when you add notes within tasks in the response playbook on the Response page. |
|
|
AI-generated icon replaced with label |
The |
|
|
Help updates |
The following updates have been made to the Help:
|
(AI-generated) icon has been replaced with the Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Exchange workflow notification |
As a content author with the Administrator role, once you’ve submitted a request to publish your workflow to Exchange, you will be notified of whether it was approved or rejected by the content moderator; the pop-up appears by the notification bell in the XDR header. |
|
|
Choose Automation Remote to use on-premises integration as target in workflow |
Now you can use an on-prem integration as a target in your workflow. Navigate to Administration > Integrations and choose the on-prem integration. Enter the required information to enable the integration, such as name and authentication credentials. Now choose an Automation Remote, the virtual appliance setup that will enable your workflows in XDR to communicate with this integration inside your network, though it is not exposed to the internet. Refresh the drop-down list to see the connected Remotes to choose from. Or add and configure a new Remote. Once the integration is connected, it can also be seen on both the Administration > Integrations page and the Automate > Targets page. Now you can choose this on-prem integration to be used as a target when the workflow is run. |
|
|
Help updates |
The following help topics have been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
| Feature | Description | Help Topic |
|---|---|---|
|
Network Visibility Cloud Module |
The Network Visibility Module has been separated into two different versions of the module when creating deployments. When creating a new deployment, select Network Visibility Module for the on-premises version, or select Network Visibility Cloud Module for the cloud version. |
Create Deployment |
|
Help update |
The following help topic has been updated:
|
Administration
| Feature | Description | Help Topic |
|---|---|---|
|
Slack Instant Message notification setting |
You can now set up your notifications to send an instant message through Slack based on the notification type in the Settings tab on the Notifications page. You must ensure that you have the Slack integration configured on the Integrations page prior to configuring the instant message setting for a notification type. |
Notifications |
|
New Automation Exchange notification type |
The new Automation Exchange notification type has been added to the Notifications page and the Notifications popup. It is triggered when an Automation workflow that you submitted is approved or rejected by the content moderator for publishing to Exchange. |
Integrations
| Feature | Description | Help Topic |
|---|---|---|
|
Microsoft Azure Active Directory - Users integration update on the Integrations page |
The Microsoft Azure Active Directory - Users integration has been renamed to Microsoft Entra ID. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Help updates |
The following help topics have been updated:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
| Feature | Description | Help Topic |
|---|---|---|
|
AI-generated icon replaced with label |
The |
Resources
No new customer-facing features or updates in this release.
2.24
Release Date: August 14, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
Updated the MITRE ATT&CK® Coverage Map topic with a new screenshot to align with the UI. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Timeline added to the incident details Overview page |
The Timeline panel has been added to the Attack Graph panel on the incident details Overview page. The timeline (color-coded by disposition) reflects the volume of events at different points in time. |
Overview |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
Updated the timeline descriptions in the Timeline topic and the Investigation Results topic. |
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Actuator |
Now you have the option to select an actuator for which a workflow is meant to act. Choose from Endpoint, Network, Process, or Other to signify what the action should be taken on. |
|
|
Playbook Task workflow |
We’ve added a new workflow intent. The Playbook Task workflow is designed to be used for playbook tasks and/or incident automation rules. Navigate to Automate > Workflows > Create Workflow and choose Playbook Task Workflow. Enter its name, action(s), observable type(s), and actuator. After you configure this type of workflow, you’re able to select the workflow from the Playbook Editor when editing a response task. |
|
|
Workflow audit trail in Exchange |
An audit trail is now provided for each workflow that’s submitted to Exchange for publication. Navigate to Automate > Exchange > Submissions and choose the workflow. Click Comments to view its history, including timestamps, versions, and status changes, such as the initials of who submitted the workflow and when it was approved for publishing. |
|
|
Large String variable |
Functionality for the Large String variable has been expanded. The Execute Python Script activity can now support and resolve Large String variable references in script arguments. |
|
|
Help update |
The following help topic has been updated:
|
Assets
| Feature | Description | Help Topic |
|---|---|---|
|
Help update |
Renamed the Microsoft Active Directory - Users source to Microsoft Entra ID in the Sources topic. |
Client Management
| Feature | Description | Help Topic |
|---|---|---|
|
Help update |
Added a note about uninstalling pre-exisiting Secure Client deployments before installing Cisco XDR Cloud Management deployments to the Deployment Management topic. |
Administration
No new customer-facing features or updates in this release.
Integrations
| Feature | Description | Help Topic |
|---|---|---|
|
New Splunk Cloud Integration |
The new Splunk Cloud integration has been added to the Cisco tab on the Integrations page. The Splunk Cloud Platform lets you investigate, monitor, analyze and act on your data with unprecedented insight, all from the cloud. Splunk experts manage your IT backend so you can focus on acting on your data, while the platform scales to your analytics needs. Make the most of all your data while maintaining privacy and compliance standards with our industry-certified platform. When you configure the Splunk Cloud integration, a target will become available in XDR automation for automated workflows. |
Cisco and Third-Party Integrations and Supported Capabilities |
|
Proofpoint Email Protection integration update on Integrations page |
The Proofpoint Email Protection integration has been renamed to Proofpoint Threat Protection. |
Cisco and Third-Party Integrations and Supported Capabilities |
| Help update |
Updated the Security Operations Center (SOC) Automation column for the Microsoft Intune integration from No to Yes in the Cisco Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
| Feature | Description | Help Topic |
|---|---|---|
|
Help update |
The new Documentation Search topic has been added to provide more information on the built-in search functionality in the Cisco XDR Help. |
2.23
Release Date: July 31, 2024
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Application badge |
The new application badge (XDR) has been added to the Select Organization area when you log in to Cisco XDR. The XDR application badge indicates that the current organization is a Cisco XDR organization. |
|
|
Help updates |
The following updates have been made to the Help:
|
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New MITRE ATT&CK®Coverage Map page added to Control Center |
The new MITRE ATT&CK® Coverage Map page has been added to Control Center in the left navigation menu. The MITRE ATT&CK® Coverage Map page provides a comprehensive visualization of the tactics and techniques that are covered by the following Cisco Breach Protection Suite products: XDR Native (Network, Cloud, Identity, and Endpoint), Secure Email Threat Defense, Secure Endpoint, Secure Malware Analytics, and Secure Network Analysis.
|
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Playbook task drawer added to Response page |
You can now click a playbook task title on the Response page to view the notes that were manually added to the task and results of any automated workflows that have been executed for the task in the task drawer. Click Add note in the lower portion of the drawer to open a text editor where you can document your findings and set the task status to Non applicable or Complete. |
Response |
|
Playbook task status on Response page |
The following new task statuses are now displayed as a badge after a workflow is executed on the Response page: Running, Complete, Errored, and Action Required. You can also manually set the task status to Complete or Not applicable when you add a note. |
|
|
Add note and set status |
The Add Note button is now an Add Note icon on the Response page and it is available for all tasks. When you click the |
|
|
User input for Automation workflow in playbook task |
When a workflow is executed for a playbook task, the Action Required badge is now displayed if user input is required. Click View to open the Automation task and provide your input to enable the workflow to continue to run. |
|
|
Secure Firewall events in Private Intelligence |
Some Secure Firewall events that were uploaded to the Security Services Exchange in the cloud were sent to Private Intelligence and they were also available through the Secure Firewall integration in Cisco XDR. Moving forward, those events are no longer stored in Private Intelligence but they will continue to be available through the Secure Firewall integration. |
— |
|
Secure Network Analytics alarm data update |
Secure Network Analytics 7.4.2 and 7.5.0 alarm data is used in Endpoint Detection and Response correlated attack chains, which can now be promoted to Cisco XDR as incidents using a webhook through Response Management. For more information, see the Alarm Configuration for Cisco XDR Guide 7.4.2 and Alarm Configuration for Cisco XDR Guide 7.5.0. |
— |
(Add Note) icon, it now opens the task drawer and displays the text editor in the lower portion of the task drawer. Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Event-based and schedule-based triggers have been deprecated and superseded by Automation rules |
Event definitions and schedule definitions are legacy objects and have been deprecated. Soon, triggers using event definitions and schedule definitions will no longer work. Instead, create Automation rules that can be used to trigger workflows. Go to Automate > Triggers > Automation Rules and click Add Automation Rule. Select the rule type, fill in its criteria, and select the workflow(s) to be run when the criteria are met. |
|
|
Time Range calendar |
You can use the new Time Range type of calendar to define a time frame with repeating days of the week and time ranges on those days. |
|
|
Specify when you would want an Automation rule to execute its workflows |
You now have the option to limit when an Automation rule's workflows would be run by adding a condition to the rule in which you specify a calendar. Then, only events that happen within the calendar definition can trigger this Automation rule to execute its associated workflows. When creating or editing the Automation rule, add a condition with the following:
|
|
|
Prompt task supports array of objects |
Now the dropdown select form element also allows you to choose the label key from an object type array. |
|
|
Help update |
The following help topic has been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Webex Instant Message notification setting |
You can now set up your notifications to send an instant message through Webex based on the notification type in the Settings tab on the Notifications page. You must ensure that you have the Webex integration configured on the Integrations page prior to configuring the instant message setting for a notification type. |
Notifications |
Integrations
| Feature | Description | Help Topic |
|---|---|---|
|
New Proofpoint Email Protection integration |
The new Proofpoint Email Protection integration has been added to the Third-Party tab on the Integrations page. Proofpoint Email Protection is an email security gateway that analyzes and classifies email to protect against various kinds of email-borne threats including malware, BEC, and more. In Cisco XDR, Proofpoint provides information about detected security threats for correlation and analysis. |
Cisco and Third-Party Integrations and Supported Capabilities |
| Help updates |
The following updates have been made to Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
No new customer-facing features or updates in this release.
2.22
Release Date: July 17, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Contain Incident: Assets (Users) task for playbook |
The new Contain Incident: Assets (Users) task has been added to the Containment phase in the Cisco Managed Incident Playbook. This task uses user-based containment to stop the spread of malicious activity. The new XDR - Contain Incident: Users workflow has been added to the Contain Incident: Assets (Users) task. This workflow consumes one or more usernames or email addresses and attempts to lock out or disable matching users in all supported products. The currently supported integrations include Cisco Duo. |
|
|
Restore Contained Users task for playbook |
The new Restore Contained Users task has been added to the Recovery phase in the Cisco Managed Incident Playbook. This task confirms and acknowledges that the eradication steps are working as expected and that users can resume accessing systems. The new XDR - Restore Users workflow has been added to the Restore Contained Users task. This workflow consumes one or more usernames or email addresses and attempts to restore matching users in all supported products. The currently supported integrations include Cisco Duo. |
|
|
Help updates |
The following updates have been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Default values for variables |
Variables now have default values set so that workflows using them don’t fail during execution due to variables missing expected values. When an action references a variable that previously didn’t resolve a value, the workflow execution can now pull in a default value based on the variable type. When an action-generated, dynamic property is referenced in a next action, if no value was provided, that property now gets initialized with a default value. |
|
|
Add comments to submissions in Exchange |
When a content author submits a new or updated version of a workflow for publishing to Exchange, they can now add comments to their submission to be shared privately with the content moderator. For instance, add comments that clarify the workflow, elaborate on the request, or answer questions. Then, view replies, take actions, or add more comments as needed. This feature offers both parties a way to connect and provide information in a more efficient and timely manner. |
|
|
Rate workflows installed from Exchange |
Now you can give a workflow that you’ve installed from Exchange a rating (from 1 to 5 stars) and also see the average rating and number of ratings given to other workflows in Exchange. On the Explore tab, you can now sort the workflows shown in Exchange by their average rating. |
|
|
Trigger automation rules for incidents with any priority score |
The capability of this feature has been expanded. Now an Incident rule can cause a workflow that you associate with it to be executed when Cisco XDR notifies Automation of a new incident, regardless of its priority score. |
|
|
Help update |
The following help topic has been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Zero Trust Access module |
The Zero Trust Access module is now available for Secure Client deployments with AnyConnect VPN version 5.1.3.62 or later. Zero Trust Access reduces the attack surface by hiding applications, and expands your level of knowing, understanding, and controlling who and what is on your network. For more information, see Zero Trust Access Module documentation in the Cisco Secure Client (including AnyConnect) Administrator Guide. |
|
|
Help updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Integrations
| Feature | Description | Help Topic |
|---|---|---|
|
New Elastic Cloud integration |
The new Elastic Cloud integration has been added to the Third-Party tab on the Integrations page. Accelerate results that matter when you use Elastic to address your search, observability, and security challenges. Deploy in your favorite public cloud, or in multiple clouds. Extend the value of Elastic with generative AI, cloud-native features and hundreds of built-in integrations to unlock the power of data, securely and at scale. From document- and field-level security to analyzing data in real time with interactive visualizations, Elastic Cloud (the Elasticsearch service) delivers powerful features that readily extend what’s possible with the Elastic Stack. Enabling this integration in Cisco XDR will make the Elastic Cloud API available as a target for automation workflows. Workflows can be used to do things like send incident data to Elasticsearch for indexing and retention. |
Cisco and Third-Party Integrations and Supported Capabilities |
| Help updates |
The AlienVault Open Threat Exchange integration has been tested and certified by Cisco Quality Assurance labs and it has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as a supported third-party integration in Cisco XDR. |
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Incidents panel update in ribbon |
The Incidents panel in the incidents app is now a list of priority incidents only. The Other area in the panel has been removed and the Priority Incidents area has been renamed to Incidents. |
|
|
Help update |
Removed the Delete Incidents section from the Incidents App topic. |
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
— |
2.21
Release Date: June 26, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Incident generation update from Secure Email Threat Defense |
Malicious messages from the Secure Email Threat Defense integration are now correlated to EDR and network alerts by the recipient of the email message. Cisco XDR will analyze messages and correlate events based on the extracted username of the recipient, allowing suspicious or malicious user activity to be correlated across domains. This will exclude common system users, such as administration, system, and root. |
— |
|
Update to user asset displayed from Secure Email Threat Defense |
The email attributes from Secure Email Threat Defense are now displayed as User under the Assets card in incident details, instead of Endpoint. |
— |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Add or remove observables in investigations |
After running an investigation, if additional observables were found that were not part of the original investigation, you can now add observables to the investigation. |
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Delete or uninstall a workflow |
Previously, workflows couldn’t be deleted or uninstalled until you deleted all of its runs first. This enhancement allows you to delete or uninstall a workflow regardless of its runs, while preserving the runs for the duration of your data retention period, as needed. |
|
|
Add workflows to automation rules |
When adding a workflow to an automation rule, if the workflow has input variables, you now have the option to click Hide input variables to reduce scrolling. When returning to a workflow with its variables configured, you now have the option to click Show input variables. Additionally, some settings have been reorganized and streamlined to simplify the configuration process. |
|
|
Help update |
The following help topic has been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
MacOS support for deployments |
Secure Client now supports deployments for macOS. To get started, install the XDR Default Deployment for macOS on your macOS devices or create new macOS deployments by clicking Create New on the Deployments page. |
|
|
Help updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Integrations
| Feature | Description | Help Topic |
|---|---|---|
|
Palo Alto Networks Cortex XDR integration update |
The Palo Alto Networks Cortex XDR integration now allows Cisco XDR to leverage Cortex alerts for enriching Cisco threat investigation capabilities. Use the Cortex integration to query for security detections of observables including IP, process name, file name, file path, MD5, SHA-256, registry key, hostname, and Cortex agent ID. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
New Check Point Quantum Smart-1 Cloud integration |
The new Check Point Quantum Smart-1 Cloud integration has been added to the Third-Party tab on the Integrations page. Check Point Quantum Smart-1 Cloud is a unified network security policy management platform for firewalls, applications, users, and workloads. With real-time threat visibility, large-scale event logging, and rich Management API. This integration uses the Management API to access Check Point NGFW alerts. Check Point NGFW is built on the basic concept of traditional firewalls but additionally includes deep packet inspection, application-level inspection, intrusion prevention, and advanced malware prevention capabilities like sandboxing. It also brings in threat intelligence from outside the firewall. Integration with Check Point Quantum Smart-1 Cloud allows Cisco XDR to leverage NGFW alerts for enriching Cisco threat investigation capabilities, by providing detailed visibility into network traffic and malicious activity. Use this integration to query for security detections of observables including IP, hostname, domain, process name, file name, URL, MD5, and SHA-256. This integration also creates a target automatically in Automation for out-of-box workflows and it also provides important device inventory context to help triage detected threats. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
Ribbon and Pivot Menu
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
Added the Add or Remove Observable section to the Pivot Menu topic to include the new add or remove observables in investigation feature. |
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
Third-Party Integrations |
2.20
Release Date: June 12, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
| Right-click node in Attack Graph panel |
You can now right-click a single node in the Attack Graph panel to open the Pivot Menu that enables you to take action on the node. You can perform some actions directly in the Pivot menu or pivot to the integrated product to perform additional actions. If the nodes are grouped, double-click the grouped node to expand it and then right-click a node to open the Pivot menu. |
Overview
|
|
New Worklog page layout |
The Worklog page in the incident details is now presented in a single combined list. You can filter the list to view logs from Automation, incident changes, notes, and response actions. Click the
|
|
|
Autosave content while editing in incident details and playbooks |
If you navigate away from the text editor or form while you add a note, edit an incident detail, or edit a playbook, the content is now automatically saved as draft for the current browser only. The draft content is not available if the same session of Cisco XDR is opened in another browser tab. To restore the content, return to the form and continue with your edits or click Undo or Use draft to remove or restore the draft content. |
|
|
Help updates |
The following updates have been made to the Help:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Right-click node in Relations Graph panel |
You can now right-click a node in the Relations Graph panel to open the Pivot menu that enables you to take action on the node. You can perform some actions directly in the Pivot menu or pivot to the integrated product to perform additional actions. If the nodes are grouped, double-click the grouped node to expand it and then right-click a node to open the Pivot menu. |
Relations Graph |
|
Autosave content while editing in investigate |
If you navigate away from the text editor or form while you start, edit, or save an investigation, the content is now automatically saved as draft for the current browser only. The draft content is not available if the same session of Cisco XDR is opened in another browser tab. To restore the content, return to the panel or form and continue with your edits or click Undo or Use draft to remove or restore the draft content. |
|
|
Help updates |
The following updates have been made to Help:
|
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Prompt task |
Now you can add a new activity to your workflow that prompts a user or users you assign to input or select requested information during the normal running of the workflow. During the workflow execution, the prompt task triggers a notification to the user(s) while the workflow waits for the response or expiration. And if the workflow was executed in response to an incident, a note about this task is automatically added to the incident’s worklog. |
|
|
Label and filter content in Exchange by intent |
Exchange content can now be more easily identified and found according to the intended use of the workflow, by the system utilizing the intent metadata (if pertinent) to filter and display them in Exchange. |
|
|
Identify system workflows |
To identify system workflows in drop-down lists more easily, they’re now prefixed with a Cisco logo icon. |
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Device details |
The Pivot menu has been added to the device name on the Device Details page. Click the |
|
|
Filters |
You can now filter using Groups on the Users page. Click Filters to open the drawer and select which Groups you want to include in your filter. |
|
|
Help updates |
The following help topics have been updated:
|
(Pivot Menu) icon to take action on the device. You can perform some actions directly in the Pivot menu or pivot to the integrated product to perform additional actionsClient Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Secure Client devices |
The Clients page now shows the number of MacOS devices under Secure Client Cloud Management in your organization. |
|
|
Help updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Notification updates |
The following updates have been made to the Notifications page and the Notifications popup:
|
|
|
Help updates |
The following updates have been made to Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Notification updates in ribbon |
The following updates have been made to the Notifications page and the Notifications popup in Cisco XDR ribbon:
|
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
Third-Party Integrations |
2.19
Release Date: May 29, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
Updated the Dashboard and Tile Settings topic with a new note in the Full Screen Dashboard section to ensure that the host computer is configured to never sleep. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Incident Report |
A new Report tab has been added to the incident detail that allows you to edit and format the AI-generated incident summary information in markdown and then download it to your computer in a single file. |
|
|
XDR Analytics source update on Detection page |
The XDR Analytics name displayed in the Source column on the Detection page has been updated to display the following: XDR Network, XDR Cloud, XDR Identity XDR Endpoint, or XDR Endpoint for NVM. This provides a more detailed view of the telemetry from Cisco Secure Cloud Analytics that produced the sighting displayed on the Detection page. |
— |
|
View run on Response page |
The View link has been updated to View run in the Actions taken panel. |
|
|
New Workflow Run drawer on Worklog page |
You can now view a high-level summary of an executed workflow in the Workflow Run drawer on the Worklog page, including information such as the workflow title, who it was started by, start and end date and time, status, and inputs. To open the Workflow Run drawer on the Worklog page, click View run next to the executed workflow in the Notes tab. Click View run details to open the full Workflow Properties and view complete information about the workflow run in Cisco XDR Automate. |
|
|
Help updates |
The following updates have been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Judgments with Matched Observables in Private Intelligence |
As background investigations were done to check for Talos published threats, judgments for all the Talos published observables in the blog were added to Private Intelligence, even if only some observables triggered an incident. To avoid confusion, only judgments for the matched observables are now stored in Private Intelligence. |
— |
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New variable types |
When building a workflow, in some cases it can be challenging to fully support complex data structures such as JSON objects by using just basic data and variable types. So we’ve introduced two new variables types - object type and array type - to improve the flexibility and capability of the workflow design process. The new variable types allow you to group together various types of data into an object, and multiple values into an array. For instance, passing the information in a returned JSON object to other activities and workflows typically required handling individual variables of each data type. Now, you can combine them into an object type variable, making it easier to share the information in the variables more efficiently. |
|
|
Workflow release notes in Exchange |
Now you can enter release notes when submitting new and updated versions of workflows for publishing to Exchange and view the release note history thereafter. |
|
|
Adding workflows to automation rules |
When you’re creating a new automation rule and adding a workflow to it, the most relevant workflows to this type of rule are now shown starting at the top of the drop-down list. This enhancement reduces the need for you to scroll down further and possibility of selecting a workflow that may not be applicable to this rule type. |
|
|
Help updates |
The following help topic has been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Device Details |
The following has been added to the Device Details drawer and Device Details page:
|
|
|
Help Updates |
The following help topics have been updated:
|
(Copy) icon.Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Device Details |
The following has been added to the Device Details drawer:
|
|
|
Help Updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New third-party integration added to the Integrations page |
The new Rubrik Security Cloud integration has been added to the Third-Party tab on the Integrations page. Rubrik Security Cloud helps you protect your data, monitor data risk, and recover data and applications, so you can keep your business moving forward. Integrating Rubrik with Cisco XDR allows SOC and IT teams to automatically take a snapshot of business-critical data early in the incident response process. Automated workflows also allow teams to rapidly recover impacted assets from recent and immutable backup snapshots. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
Ribbon and Pivot Menu
No new customer-facing features or updates in this release.
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
The new Rubrik Security Cloud integration has been added to the Third-Party Integrations topic. |
Third-Party Integrations |
2.18
Release Date: May 15, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Playbook Short description renamed to Summary and is more accessible |
The Short description in the Playbook Editor has been renamed to Summary and is now more accessible to allow you to view the full description by clicking the more link. You can then click the less link to collapse the description. |
|
|
Help updates |
The following updates have been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Publish to Exchange |
You can now share the workflows in your tenant with other users of Exchange by submitting a request to publish to Exchange. When you create a new or edit an existing workflow and validate it, you have the option to submit it to Exchange. Once it is reviewed and approved, the workflow or update to an existing workflow is published and available to install and use by everyone through Exchange. |
|
|
Authorship types |
The ability to search and filter workflows by authorship type has been added to the Exchange page. |
|
|
Duplicate a workflow |
You can now easily duplicate a system workflow like any other workflow. |
|
|
Large String variable |
Functionality for the Large String variable has been improved. The Execute Python Script activity can now support the use of the Large String variable. |
|
|
Help updates |
The following help topics have been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New third-party integrations added to the Integrations page |
The following new third-party integrations have been added to the Third-Party tab on the Integrations page:
|
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
Help updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon and Pivot Menu
|
Feature |
Description |
Help Topic |
|---|---|---|
| Copy Defang Value in Pivot menu |
The new Copy defanged value menu option has been added to the Pivot menu. This appends a square bracket to the last period or colon in an IP address, URL, domain name, or email address when you copy an observable value from the Pivot menu. For example, the defanged value of 216.238.85.220 is 216.238.85[.]220. This ensures that the observable value is copied as an inactive link, preventing you from accidentally clicking a malicious link when you paste it for later use elsewhere. |
|
| Defang on Copy toggle setting in ribbon |
The new Pivot Menu has been added to the left navigation pane on the Settings page in Cisco XDR ribbon. The Defang on Copy toggle in the Pivot Menu setting is off by default. Click the toggle to on to remove the Defang on Copy menu option from the Pivot menu and the existing Copy value menu option will update to copy the observable value as a defanged value. |
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The new PagerDuty and Red Sift integrations have been added to the Third-Party Integrations topic. |
Third-Party Integrations |
2.17
Release Date: April 24, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Attack Graph Node Drawer |
A new Node drawer has been added to the Overview page in the incident detail. You can now click a single node in the Attack Graph panel to open the Node drawer and view additional details of the selected asset or observable. If the device or person is in Cisco XDR Assets, then a View in Devices link or View in Users will be displayed in the upper portion of the drawer. Click the link to open and view the details in XDR Assets. Click View Events in the lower portion of the drawer to go to the Detection page and view the events that are associated with the node. |
|
|
Incident Short description more accessible |
The Short description in the incident detail header is now more accessible to allow you to view the full description by clicking the more link. You can then click the less link to collapse the description. This is useful for descriptions generated by Cisco AI, which are sometimes longer. You can now expand the description to view and copy it. Previously, you could only view the full Short description in a tooltip. |
|
|
View Long Description link renamed and repositioned above Short description |
The previous View Long Description link has been renamed to View detailed description in the incident detail header and has been repositioned directly above the Short description. |
|
|
Cisco Managed Incident Playbook updates |
Some of the workflows in the Cisco Managed Incident Playbook have been updated to include the following enhancements:
These enhancements affect the following workflows:
Additional enhancements were made to the following workflows:
|
|
|
Help Updates |
The following updates have been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Install and automate workflow from Exchange |
When you install a workflow from Exchange, you’re now given the option to automate the execution of this workflow by adding an automation rule to it during the installation wizard. |
|
|
Large String variable |
Functionality for the Large String variable has been improved. The system can now support up to three Large String variables per workflow. |
|
|
Lock and unlock workflows |
When importing a workflow and a sub-workflow at the same time, the sub-workflow is no longer automatically locked (importing a standalone sub-workflow does not get locked). |
|
|
Help updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Cisco integration support |
The Cisco Cyber Vision integration is now available as a source for the Devices page. |
|
|
Third-Party integration support |
The Cybereason third-party integration is now available as a source for the Devices page. |
|
|
Help updates |
The following help topics have been updated:
|
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Notification settings |
The new Settings tab has been added to the Notifications page and the existing list of notifications is now in the new Inbox tab. You can now configure the notification settings to send you an email based on the notification type. |
|
|
New Cisco integration added to the Integrations page |
The new Cyber Vision integration has been added to the Cisco tab on the Integrations page. Cisco Cyber Vision enables organizations to ensure the continuity, resilience, and safety of their industrial operations by providing continuous visibility into their industrial control systems (ICS) to understand their security posture, improve their industrial networks efficiency, and extend IT security to their industrial operations. |
Cisco and Third-Party Integrations and Supported Capabilities Cisco Integrations |
| New third-party integration added to the Integrations page |
The new xMatters integration has been added to the Third-Party tab on the Integrations page. The xMatters service reliability platform helps DevOps, SREs, and Ops teams automate workflows, ensure infrastructure availability, and deliver products at scale. Eliminate digital event disruptions by leveraging AI, analytics, and workflows to automate and accelerate response times all the way to resolution. Enabling this integration in Cisco XDR will make the xMatters API available as a target for Automation workflows. Workflows can be used to do things like send a page through xMatters when Cisco XDR incidents are generated. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
Ribbon
No new customer-facing features or updates in this release.
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help updates |
The following updates have been made to the Help:
|
Third-Party Integrations Cisco Integrations |
2.16
Release Date: April 10, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
Updated the Dashboard and Tile Settings topic with a new screenshot in the Specify Scroll Option section to align with the UI. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Confirm Incident workflow for playbook |
A new workflow has been added to the Confirm Incident task in the Cisco Managed Incident Playbook. This automation workflow updates the incident status to Incident Response and, if the incident has assignees and a compatible messaging integration is enabled, the workflow creates a chat room for incident triage and collaboration. |
|
|
Help Updates |
The following updates have been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Add new automation rule |
When you add a new automation rule, the Conditions section has been enhanced for clarity, consistency, and flexibility during the configuration. If you add more than one condition, you can choose whether all or any of the conditions must be met in order for the rule to trigger the associated workflow(s) to run. The Advanced option enables you to choose any combination of logical operators when processing the conditions sequentially. |
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Rules drawer |
The Rules drawer has been updated on the Devices page. Click Rules to open the drawer, then click the Add Rule drop-down menu to create a new rule from search or scratch. |
|
|
Device Details drawer |
The Pivot menu is now available on the Device Details drawer on the Devices page. You can use the Pivot menu to view a list of attributes for the device and perform additional tasks from attributes, such as investigate an observable or pivot to an integrated product. |
|
|
Help Updates |
The following help topics have been updated:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Deployments |
The Deployments table now includes a column for the operating system and architecture of the deployment. |
|
|
Device Details drawer |
The Pivot menu is now available on the Device Details drawer on the Clients page. You can use the Pivot menu to view a list of attributes for the device and perform additional tasks from attributes, such as investigate an observable or pivot to an integrated product. |
|
|
Help Updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Confirm Incident workflow for playbook |
A new workflow has been added to the Confirm Incident task in the Cisco Managed Incident Playbook. This automation workflow updates the incident status to Incident Response and, if the incident has assignees and a compatible messaging integration is enabled, the workflow creates a chat room for incident triage and collaboration. |
|
|
Help Update |
Replaced the asterisk with the |
Cisco and Third-Party Integrations and Supported Capabilities |
(Information) icon in the Ribbon
No new customer-facing features or updates in this release.
Resources
No new customer-facing features or updates in this release.
2.15
Release Date: March 27, 2024
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the Help:
|
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Navigation Menu Update |
The new Dashboards menu has been added to the left navigation menu for Control Center and the Control Center page has been renamed to Dashboards. |
|
|
Stay Logged In Toggle Added to Full Screen Dashboard |
The new Stay logged in toggle has been added to the upper right corner of the full screen dashboard. By default, the toggle is enabled, indicating that you will not be logged out of the current Cisco XDR session while the dashboard is maximized to full screen. If you disable the setting or exit the full screen mode, you will be logged out of the current Cisco XDR session automatically after 24 hours. |
|
|
Help Updates |
The previous Control Center topic has been renamed to Dashboards and a new Control Center topic has been added to reflect the new left navigation menu update for Control Center. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Playbooks |
The Incident Response Custom Playbooks feature (Administration > Playbooks) is now available that allows Administrators to create and manage custom playbooks for their organization. From the Playbook Administration page, you can manage and customize incident response playbooks and the rules used to assign them to new incidents. These playbooks contain the response tasks that are displayed on the Response page in the incident detail. Using the playbook Editor, you can view the playbook details, create a new playbook, edit a playbook, duplicate a playbook and customize it, specify which playbook is assigned by default to new incidents, and delete a playbook (other than the Cisco Managed Incident Playbook; this playbook cannot be deleted). The Assignment Rules feature allows you to create rules to assign playbooks to new incidents based on specific conditions of the incident. When an incident is created that matches the conditions of a rule, the associated playbook is assigned to the incident and is then displayed on that incident's Response page. |
|
|
Playbook name displays on Response page |
When viewing the response tasks for an incident on the Response page in the incident detail, the playbook name and publish date are displayed above the task list to identify which playbook has been assigned to the incident. |
|
|
Filter incidents by Priority Score |
You can now filter incidents by minimum priority score in the Filters menu on the Incidents page. Enter a number between 0 and 1000 and only incidents with a priority score greater than or equal to this value will be shown in the Incidents list. |
|
|
Cisco Secure Endpoint events now include more Mitre Tactics and Techniques information |
An issue was fixed in Cisco Secure Endpoint to include more accurate Mitre Tactics and Techniques information in an incident, which may affect the incident priority score in Cisco XDR. |
|
|
Help Updates |
The following updates have been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Include workflows in playbook tasks |
The Incident Response Custom Playbooks feature (Administration > Playbooks) is now available that allows administrators to create and manage custom playbooks for their organization. From this page, you can manage and customize incident response playbooks and the rules used to assign them to new incidents. These playbooks contain the response tasks that are displayed on the Response page in the incident detail. Using the playbook Editor, you can manage playbooks, tasks within the playbooks, and include automated workflows within the tasks. In the Workflow Editor under Response Options, set the Workflow Intent to Incident Response to make the workflow available to be included in a playbook task. |
|
|
Lock and unlock workflows |
As a user with an Administrator role, you can now lock and unlock workflows in your tenant, whether you're the author or not. Use this feature to lock a workflow and prevent it from being edited, thereby safeguarding against changes that could invalidate it and prevent an automation rule or published workflow from running, for example. When opening a workflow in the Workflow Editor, the message in the header shows whether the workflow is locked or unlocked: click it to switch between the two modes. |
|
|
Help updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Pivot Menu |
The Pivot menu is now available on the Devices page. You can use the Pivot menu to view a list of attributes for the device and perform additional tasks from attributes, such as investigate an observable or pivot to an integrated product. |
|
|
Help Update |
The following help topics have been updated:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Pivot Menu |
The Pivot menu is now available on the Clients page. You can use the Pivot menu to view a list of attributes for the Secure Client device and perform additional tasks from attributes, such as investigate an observable or pivot to an integrated product. |
|
|
Help Update |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Playbooks |
The Incident Response Custom Playbooks feature (Administration > Playbooks) is now available that allows Administrators to create and manage custom playbooks for their organization. From this page, you can manage and customize incident response playbooks and the rules used to assign them to new incidents. These playbooks contain the response tasks that are displayed on the Response page in the incident detail. Using the playbook Editor, you can view the playbook details, create a new playbook, edit a playbook, duplicate a playbook and customize it, specify which playbook is assigned by default to new incidents, and delete a playbook (other than the Cisco Managed Incident Playbook; this playbook cannot be deleted). The Assignment Rules feature allows you to create rules to assign playbooks to new incidents based on specific conditions of the incident. When an incident is created that matches the conditions of a rule, the associated playbook is assigned to the incident and is then displayed on that incident's Response page. |
|
|
New Third-Party Integration Added to the Integrations Page |
The new Zendesk integration has been added to the Third-Party tab on the Integrations page. Zendesk provides a complete customer service solution that is easy to use and scales with your business. Enabling this integration in Cisco XDR will make the Zendesk API available as a target for Automation workflows. Workflows can be used to perform tasks such as creating Zendesk tickets when Cisco XDR incidents are generated. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
Authorship Type Added to Integrations Page |
The authorship type badge has been added to the Integrations page, indicating who created the integration.
You can also filter the integrations based on the authorship type. The Filters button has been replaced with Capabilities and Authorship Type drop-down lists. |
|
| Help Updates |
The following updates have been made to the help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
No new customer-facing features or updates in this release.
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
The new Zendesk integration has been added to the Third-Party Integrations topic. |
Third-Party Integrations |
2.14
Release Date: March 13, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New, Unassigned Incidents Automatically Triaged |
When the incident detail for a new, unassigned incident is first viewed on the Incident Detail page, the user who viewed the incident is automatically assigned to it and the incident status is changed to Open. |
|
|
Help Updates |
The following updates have been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Rules Drawer
|
When creating or editing a rule, you can now collapse the sections of the Rules drawer. |
|
|
Help Update |
The following help topics have been updated:
|
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Integrations Page Update |
The available integrations on the Integrations page are now organized into the new Cisco and Third-Party tabs. Click the Cisco tab to display all the available Cisco integrations or click the Third-Party tab to display all the available third-party integrations. |
|
|
Umbrella Integration Update |
The new Investigate Enabled check box has been added to the Add Integration form for the Umbrella integration. When you provide one API key for multiple Umbrella functions, it now includes the Investigate function. |
— |
|
New Third-Party Integrations Added to Integrations Page |
The following new integrations have been added to the Third-Party tab on the Integrations page:
|
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
Integration Removed from Integrations Page |
The ServiceNow SecOps integration has been removed from the Third-Party tab on the Integrations page. Any existing ServiceNow SecOps integrations configured will not be affected. |
— |
|
Help Update |
Updated the Asset Inventory and Context column from Yes to No for the Cybereason integration in the Cisco and Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
No new customer-facing features or updates in this release.
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
Removed the device inventory feature support from the description for the Cybereason integration in the Third-Party Integrations topic. |
Third-Party Integrations |
2.13
Release Date: February 28, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Source Link |
The Source column in the Incidents list and the Events table on the incident details Detection page is now linked and shows a jump icon to take you to the event in the originating product. |
|
|
Help Updates |
The following updates have been made to the Help:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Source Link |
The Events table on the Investigation Results page now includes a link for the Source. Click the Source link to open the event in the originating product. |
|
|
Help Updates |
The following updates have been made to the Help:
|
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Workflow Intent |
When creating a workflow, you can start with a blank workflow or choose the intent of the workflow to gain some configuration assistance and expedite the build process.
|
|
|
Variable Browser |
Added three new workflow output properties for incident response workflows:
|
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Users |
The Users feature and the Microsoft Azure Active Directory - Users integration are now out of Beta. |
|
|
Device Details Update |
The Seen in Sources section of the Device Details page now includes a link to view the device data provided by that source. Click View full details to view the source data. |
|
|
Help Updates |
The following updates have been made to the help:
|
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
| Help Update | Replaced the text under the Secure Email Threat Defense integration with a popup in the Cisco and Third-Party Integrations and Support Capabilities topic. | Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Incidents App Updates |
The following updates have been made to the incidents app in ribbon:
|
Resources
No new customer-facing features or updates in this release.
2.12
Release Date: February 14, 2024
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated screenshots showing the new left navigation menu. |
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Navigation Menu Updates |
The left navigation menu has been updated in Cisco XDR with new menu icons. A drawer now opens with additional menus when you hover or click a menu in the navigation menu and the |
(Cisco XDR Menu) icon is now located in the upper left corner of the navigation menu.Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the Help:
|
(Notifications) icon in the Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the Help:
|
Intelligence
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the Help:
|
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Default Targets |
Added two new default targets, Conure and Insights APIs. |
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Export to CSV Update |
The Export to CSV feature on the Devices and Users pages has been updated to be only available to users with an Administrator role. |
|
|
Filters Update |
The Filters drawer on the Devices page has been updated to include the Last Active field. Select a start and end date to filter by the specified time range. |
|
|
Device Details Update |
The Security Products and Windows Security Center cards have been combined on the Device Details page. |
|
|
Help Updates |
The following updates have been made to the help:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Export to CSV Update |
The Export to CSV feature on the Clients page has been updated to be only available to users with an Administrator role. |
|
|
Filters Update |
The Filters drawer on the Clients page has been updated to include the Last Active field. Select a start and end date to filter by the specified time range. |
|
|
Help Updates |
The following updates have been made to the help:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Microsoft Application Added to Microsoft Cloud Integration |
The new Microsoft Defender for Office 365 application is now available on the Microsoft Cloud integration page. Microsoft Defender for Office 365 is a cloud-based email filtering service that helps protect your organization against advanced threats delivered via email and collaboration tools, like phishing, business email compromise, and malware attacks. In Cisco XDR we enable Defender for Office 365 users to leverage email intelligence and detections while performing incident investigations and threat hunting. Use the Microsoft Defender for Office 365 integration to search for security detections and associated indicators, reputations and references, involving specified email addresses, URLs, email subjects, message IDs, IPs, domains, or file hashes. It also creates a target automatically in Automation for out-of-box workflows. |
Third-Party Integrations Cisco and Third-Party Integrations and Supported Capabilities |
|
Microsoft Defender for Endpoint Application Update |
The Microsoft Defender for Endpoint third-party integration is now included in the Cisco XDR correlated incident creation. Microsoft Defender for Endpoint security events can now generate and contribute to incidents in Cisco XDR, in addition to existing sources from Cisco Secure Firewall, Cisco Secure Client Network Visibility Module, Cisco Secure Endpoint, CrowdStrike, and the network and cloud detections that are natively built into Cisco XDR analytics. |
Third-Party Integrations Cisco and Third-Party Integrations and Supported Capabilities |
|
New Third-Party Integration Added to Integrations Page |
The new Slack third-party integration has been added to the Integrations page. Slack brings team communication and collaboration into one place so you can get more work done, whether you belong to a large enterprise or a small business. This integration allows Cisco XDR users to leverage Slack as a team collaboration and communication tool in Automation workflows, including incident notification and response. |
Third-Party Integrations Cisco and Third-Party Integrations and Supported Capabilities |
|
Jamf Pro Integration Update |
The existing Jamf Pro integration is no longer used and it is indicated as deprecated on the Integrations page. To continue using Jamf Pro as a source in Assets, you must configure the new Jamf Pro integration to use the API client credentials in Jamf Pro instead of basic authentication. For more information, see Classic API Authentication Changes. We recommend that you remove the deprecated Jamf Pro integration after you add the new Jamf Pro integration. |
— |
|
Help Updates |
The following updates have been made to the Help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Orbital Script Added to Orbital App |
The new Script tab has been added to the Orbital app in Cisco XDR ribbon. Script provides the ability to counteract any threats found using Query. For more information on the script feature in Orbital, see the Orbital Scripts help topic in Orbital. |
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the Third-Party Integrations topic:
|
Third-Party Integrations |
2.11
Release Date: January 31, 2024
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
Added the new notifications feature to the What's New section. |
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
Updated the screenshot in the Control Center topic to align with the UI. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
AI Generated Icon and Tooltip |
The The icon is displayed:
Note:
|
|
|
Updated text in Filtering Incidents by Date Range |
Updated the text to reflect what the filters by date range are actually showing; The incidents that are displayed in the list are those that have shown activity or been updated during the specified date range. |
|
|
Help Updates |
The following update has been made to the Help:
|
(Edit) icon is not available for AI generated incident Title and Short Description. Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Third-Party Integration Support |
The Palo Alto Network Cortex XDR third-party integration now provides device data for the Devices page. |
|
|
Help Updates |
The following updates have been made to the help:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated the Clients, Deployments, Deployment Management, Audit Logs, Profiles, and Device Events topics with new screenshots to align with the UI. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
| New Notifications Icon |
A new The number of new notifications is displayed as a badge next to the Notifications icon in the Cisco XDR header. Click the Notifications icon to view and manage your notifications in the Notifications popup. |
|
|
New Notifications Page |
The new Notifications page has been added to the Administration section in the navigation menu. You can view and manage all your unread and read notifications on the Notifications page. |
|
|
New Third-Party Integration Added to Integrations Page |
The new Microsoft Cloud third-party integration is now available on the Integrations page. This new integration allows you to manage and maintain one set of Microsoft cloud credentials across multiple product integrations between Cisco XDR and Microsoft products. The existing Microsoft Defender for Endpoint integration has been removed from the Integrations page and it has been added as an application within the Microsoft Cloud integration. To add a new Microsoft Defender for Endpoint integration, you must first add a Microsoft Cloud integration. You will then be able to configure the Microsoft Defender for Endpoint application in Microsoft Cloud to use those cloud credentials. Future integrations of other Microsoft cloud-driven applications can then be configured via the same Microsoft Cloud integration to use those shared credentials. If you have an existing Microsoft Defender for Endpoint integration configured, it is automatically migrated to the new Microsoft Cloud integration. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
Add Integration Update |
The health check message is now displayed as a status in the upper right corner of the Add Integration form. It shows whether the integration is Connected or if there is an Error with the configuration. |
|
|
Help Updates |
The following updates have been made to the help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Notifications |
The following updates have been made to Notifications in ribbon:
|
|
| AI Generated Icon and Tooltip |
The Note: You cannot edit AI generated incident title, short description, and long description. |
Incidents App |
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
| Help Updates |
The following updates have been made to the Third-Party Integrations topic:
|
Third-Party Integrations |
2.10
Release Date: January 17, 2024
New Features and Updates
Getting Started
No new customer-facing features or updates in this release.
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following help topics have been updated:
|
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following update has been made to the Help:
|
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
No new customer-facing features or updates in this release.
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following update has been made to the Sources topic:
|
Client Management
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the help:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
No new customer-facing features or updates in this release.
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
| Help Updates |
The following updates have been made to the Third-Party Integrations topic:
|
Third-Party Integrations |
2.9
Release Date: December 6, 2023
New Features and Updates
Getting Started
Control Center
Incidents
No new customer-facing features or updates in this release.
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Updated Workflows in Exchange |
Exchange enables you to find, install, and use workflows that have been built and approved by Cisco engineers and content providers. Now you can collectively see all the workflows you have installed from Exchange, and when a workflow configuration or object is changed, you're shown and given the option to update to the newer version. Exchange indicates when the workflow was installed in your tenant and whether an update is available for it now. |
|
|
Help Updates |
The following help topic has been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Cisco Integration Support |
The Cisco Duo integration now provides user data for the Users page. |
|
|
Third-Party Integration Support |
The Cybereason third-party integration now provides device data for the Devices page. |
|
|
Device Details Drawer |
A new Device Details drawer provides an overview of the data associated with the selected device. Click a Device Name to open the Device Details drawer. |
|
|
Help Updates |
The following updates have been made to the help:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Deployments |
The process to create new deployments and edit existing deployments has been updated to a stepped wizard. On the Deployments page, click Create New to open the Create Deployment page, which will guide you through a step by step process to create new deployments. |
|
|
Device Details Drawer |
A new Device Details drawer provides an overview of the data associated with the selected device. Click a Device Name to open the Device Details drawer. |
Clients |
|
Help Updates |
The following updates have been made to the help:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Cisco Integration Added to Integrations Page |
The new Webex integration has been added to the Integrations page. Webex offers secure, integrated audio, video, and content sharing from any device, anywhere. Intelligent features such as noise removal, Webex Assistant, with real-time translations and People Insights automate meeting tasks to help you work smarter. In Cisco XDR, integrating Webex allows you to send notifications from your XDR automation workflows. |
Cisco and Third-Party Integrations and Supported Capabilities Cisco Integrations |
|
Help Update |
Updated the Asset Inventory and Context column from No to Yes for the Cybereason integration in the Cisco and Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Pivot Menu Updates |
The following updates have been made to the Pivot menu:
|
|
|
Automation Workflow Notification |
A new Automation Workflow notification has been added to Notifications in Cisco XDR ribbon and it is displayed in the Notifications popup and on the Notifications page when an Automation workflow or rule is temporarily disabled. |
|
|
Help Updates |
Updated the Pivot Menu, Investigate Using Ribbon Extension, Casebook App, and Observables topics with new screenshots of the pivot menu to align with the UI. |
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following updates have been made to the help:
|
Third-Party Integrations Cisco Integrations |
2.8
Release Date: November 22, 2023
New Features and Updates
Getting Started
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Customize Dashboards Updates |
The following changes have been made to the Customize Dashboards dialog box:
|
|
|
Control Center Page Update |
The Edit Dashboards button on the Control Center page has been renamed to Customize Dashboards. |
Incidents
No new customer-facing features or updates in this release.
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Sync and Highlight Asset Labels |
The sync and highlight functionality has been extended to include asset labels. You can now select a label for an asset in the Assets and Observables panel or Asset Labels drawer to highlight all asset nodes in the Relations Graph panel that contain that asset label. This, in turn, highlights all other assets in the Assets and Observables panel, Indicators panel, and Events table that are associated with the nodes highlighted in the Relations Graph panel. Asset labels are present if the asset is assigned labels in Cisco XDR Devices. To select multiple labels in the Assets and Observables panel, press the ctrl key (Windows) or command key (Mac) while clicking the labels or use the |
|
|
Asset Labels Drawer |
The number of labels displayed in the Assets and Observables panel depends on the length of the label. Any additional labels are indicated by a +n value (for example, +1). To view all the labels, click the +n link to open the Asset Labels drawer. From the drawer, you can see all the labels that are associated with the asset. You also have the same functionality to sync from the drawer as you do from the Assets and Observables panel. |
|
|
Timeline Refresh |
A new |
|
|
Help Updates |
The following updates have been made to the Help:
|
(Select) icon in the Graph Controls.
(Timeline Refresh) icon has been added to the Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Automation Rules |
Use Automation Rules to configure when a workflow is automatically executed, such as according to a schedule or in response to an incident or specific event. The ability to add Automation Rules directly to a workflow is now included in the Workflow Editor for quicker access and enhanced usability, where you can select rule types, add one or more rules, and activate an association between the workflow and each rule, so that the workflow is enabled to automatically run when the rule conditions are met. |
|
|
New Workflow |
XDR - Automation Rule - Update Incident Properties workflow released. This new workflow can be used with Incident Automation Rules to update an incident's properties. For example, you may use this workflow to automatically assign specific incidents to a certain person. Supported properties include assignees, description, short description, title, status, and severity. |
|
|
Help Updates |
The following help topics have been updated:
|
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The new Cohesity Data Cloud third-party integration is now available on the Integrations page. Integrating Cohesity DataProtect with Cisco XDR allows SOC and IT teams to automatically take a snapshot of business-critical data as often as needed, early in the incident response process. Automated workflows also allow teams to rapidly recover impacted assets from recent and immutable backup snapshots. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
User ID Added to My Account Page |
A new User ID field has been added to the My Account page. |
|
|
Help Update |
Updated the Asset Inventory and Context column from No to Yes for the Trend Vision One integration in the Cisco and Third-Party Integrations and Supported Capabilities topic. |
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Orbital App Updates |
The following updates have been made to the Orbital app in Cisco XDR ribbon:
|
Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated the description for the Trend Vision One integration to include device inventory feature support in the Third-Party Integrations topic. |
Third-Party Integrations |
2.7
Release Date: November 8, 2023
New Features and Updates
Getting Started
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
A new Getting Started topic has been added to help users sign in, configure, and use the basic features of Cisco XDR. |
Control Center
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Assets in Incidents List and Assets Drawer |
A new Assets column in the Incidents list shows the top asset associated with the incident based on asset value and the value that has been assigned to it (if available). If there are multiple assets associated with an incident, click +more in the Assets column beneath the asset name to open the Assets drawer. The Assets drawer shows all the assets associated with the incident and the number of events where the asset was seen. |
|
|
Search Incidents by Asset Name |
You can now search the Incidents list by asset name. Enter the exact asset name in the Search field to find the incidents that include the original assets as an exact match. |
|
|
Help Updates |
The following help topics have been updated:
|
Incidents |
Investigate
No new customer-facing features or updates in this release.
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Approval Task Notification |
Creating an approval task will now notify the assignees through the Notifications icon in the Cisco XDR ribbon that they have been assigned a task and provide a link to review the task and approve or reject the request. |
|
|
Help Updates |
The following help topic has been updated:
|
Assets
No new customer-facing features or updates in this release.
Client Management
No new customer-facing features or updates in this release.
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
CrowdStrike Integration Update |
The CrowdStrike third-party integration is now included in the Cisco XDR correlated incident creation. CrowdStrike security events can now generate and contribute to incidents in Cisco XDR, in addition to existing sources from Cisco Secure Firewall, Cisco Secure Endpoint, Cisco Secure Network Visibility Module, and the network and cloud detections that are natively built into Cisco XDR analytics. |
Third-Party Integrations |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Ribbon Extension |
The new Cisco XDR ribbon extension is now available for the Google Chrome, Mozilla Firefox, and Microsoft Edge browsers. The Cisco XDR ribbon extension offers a distributed set of capabilities that unify visibility, enable automation, accelerate incident response workflows, and improve threat hunting directly from your browser. |
|
|
Automation Approval Task Notification |
A new Automation Task Approval notification has been added to Notifications in Cisco XDR ribbon and it is displayed in the Notifications popup and on the Notifications page when an approval task from Automation is assigned to you by other users. |
|
|
Help Updates |
The following help topics have been updated:
|
(Options) icon to the Resources
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following help topics have been updated:
|
Third-Party Integrations |
2.6
Release Date: October 25, 2023
New Features and Updates
Control Center
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Workflow Run Drawer |
You can now view a high-level summary of an executed workflow in the Workflow Run drawer on the Response page, including information such as the workflow title, who it was started by, start and end date and time, status, and inputs. To open the Workflow Run drawer on the Response page, click View in the Actions taken panel next to the executed workflow. Click View run details to open the full Workflow Properties and view complete information about the workflow run in Cisco XDR Automate. |
|
|
Source in Event Drawer Linked to Integration Instance |
The Source field in the Event drawer is now linked to an instance of the integration that reported it. |
|
|
Help Updates |
The following help topics have been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Investigation Filters |
By default, all investigation data (internal and external to your environment) is shown on the Relations Graph, Assets and Observables, and Indicators panels on the Investigation Results page. The Events table shows only events from your environment by default. New check box filters have been added to the Investigation Results page and to the Events table that allow you to toggle between showing only data internal to your environment or showing all data (internal and external to your environment). My Environment Only FilterIn the upper portion of the Investigation Results page, the My environment only check box is available to filter the overall investigation results to show only data that is internal to your environment. When this check box is checked, all data outside of your environment is excluded. The Events table is forced to display only events from your environment and the My environment events only check box for the Events table is disabled. My Environment Events Only Filter On the Events table, the My environment events only check box is available to filter for all events (internal and external to your environment) or only events internal to your environment. By default, the check box is checked to show only events internal to your environment, as indicated by the You can uncheck the check box to show all events in the Events table if the My environment only check box in the upper portion of the page is unchecked. Note: If the My environment only check box is checked, the My environment events only check box becomes disabled and cannot be toggled to show all events (internal and external) because the page filter overrides the Events table filter. |
|
|
Source in Event Drawer Linked to Integration Instance |
The Source field in the Event drawer is now linked to an instance of the integration that reported it. |
|
|
Help Updates |
The following help topics have been updated:
|
(Internal Event) icon. Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Workflow Drawer |
On the Workflows page, click on a workflow to open a drawer on the right that displays a high-level summary including description, categories, response actions, variables, triggers, and targets. Click View workflow to see more information in the Workflow Editor. |
|
|
Cisco XDR Licensing Tier Enforcement |
Third-party integrations and their components will not appear for use in Automation if your organization’s licensing tier is Cisco XDR Essentials. You can view your Organization Tier on the My Account page. At the bottom of the Integrations page, a message is displayed with additional information on how to upgrade your license to Cisco XDR Advantage or Cisco XDR Premier to benefit from third-party integrations. For details on the licensing tiers, see Cisco XDR Licenses. |
— |
|
Updated Atomic Actions |
Orbital and Umbrella (v2) atomic actions have been updated to support integration-provided targets. |
— |
|
Updated Workflows |
These existing workflows have been updated:
|
— |
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Devices and Users Tables |
You can now click and drag column headers to reorder the columns in the Devices and Users tables. |
|
|
Help Updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The new Darktrace RESPOND & DETECT third-party integration is now available on the Integrations page. Use the Darktrace integration to query for security detections of observables including IP, hostname, and Darktrace device ID. It also enables users to leverage the integration for threat hunting and investigation features. |
Cisco and Third-Party Integrations and Supported Capabilities Third-Party Integrations |
|
Umbrella Integration Update |
New API settings have been added to the Add Integration form for Umbrella. You can now provide one API key for multiple Umbrella functions (Reporting, Network Devices, and Management). |
— |
|
Help Updates |
Updated the My Account and Users topics with new screenshots to align with the UI. |
Ribbon
Resources
2.5
Release Date: October 4, 2023
New Features and Updates
Control Center
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Events label added to table on Detection page |
Previously, there was no label on the table on the Detection page in the incident details. The table now includes the Events label to give users a better understanding of what is being displayed. |
|
|
Help Update |
Updated the screenshot in the Incidents Detection topic to show the Events label on the table. |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Relation Graph Filter Badge |
When filters are applied to the Relations Graph using the |
|
|
Help Updates |
Updated the Relations Graph and Investigation Results topics to include new Filter menu screenshot and information about the new badge when filters are applied. |
(Filter) icon in the graph control, the number of selected filters is now displayed as a badge on the icon so you have a visual of how many filters have been applied once the Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Atomic Actions |
The following new atomic actions are now available in Exchange:
|
|
|
Large String Variables |
For strings greater than 1 MB in size that are needed as inputs to other activites in your workflow, we've added a new Large String workflow variable data type that supports strings up to 10 MB in size. |
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Rules Drawer |
The Rules drawer now has an Options menu where you can choose to edit or delete the rule. |
Devices |
|
Edit Columns |
The Edit Columns button on the Devices and Users page has been removed and you now use the |
|
|
Help Updates |
The following help topics have been updated:
|
(Edit Columns) icon in the table header to select which columns to display.Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Edit Columns |
The Edit Columns button on the Clients page has been removed and you now use the |
|
|
Help Updates |
Updated the Clients topic to include new Sort and Edit Columns section and updated screenshots to align with the UI. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The new ExtraHop Reveal(x) 360 third-party integration is now available on the Integrations page. Integration with ExtraHop Reveal(x) Enterprise allows you to automatically search for devices, add or remove devices from a watchlist, and search for detections. This integration also creates an HTTP target automatically in Automation for out-of-box workflows. |
Third-Party Integrations |
|
Help Updates |
The following help topics have been updated:
|
Cisco and Third-Party Integrations and Supported Capabilities |
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Pivot Menu Icons Added to Assets |
When you view incidents in the incidents app, each asset listed in the Incident Overview panel now has a |
Resources
2.4
Release Date: September 20, 2023
New Features and Updates
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Tile Name and Data Format Updates |
The Incident statuses and assignees tile has been renamed to Incident Status by Assignment and the tile data format has been updated from a donut chart to a horizontal bar chart. Note: If you have an existing Incident status and assignees tile on your dashboard, an error message is displayed on the tile. You must remove the tile from the dashboard and then add the new Incident Status by Assignment tile to your existing dashboard. For details on removing tiles and modifying tiles on a dashboard, see Configure Dashboards and Tiles. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Disposition Filters in Observables Drawer |
You now have the ability to filter observables by disposition in the Observables drawer on the Overview page in the incident details. The filter labels indicate how many observables are associated with each disposition. Click the Disposition filter in the upper portion of the drawer to narrow the display of observables with that disposition. |
|
|
Help Updates |
The following help topic has been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Attributes in Node Drawer Sorted by Type |
When a node is selected in the graph, the attributes listed in the Node drawer are now sorted alphabetically by type. |
|
|
Filter Investigation Results |
The investigation results show nodes from all sources and dispositions by default. You can now filter the nodes using the Sources and Disposition filters to narrow the display and show only those nodes that match the filters you have selected. When filters are used, they apply to all to all panels on the Investigation Results page.
|
|
|
Help Updates |
The following help topics have been updated:
|
Intelligence
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Updated Environment Filter |
The environment filter label on the Events page now displays as Environment until you choose the filter (All, Internal, or Global). |
|
|
Help Updates |
The following help topic has been updated:
|
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Run Drawer |
On the Runs page, click on a run to open a drawer on the right that displays a high-level summary of the workflow execution. Then click View run details to see more information. |
|
|
Array Operator Labels in Rule Conditions |
When building an automation rule, for array variables in conditional statements, the comparison operator labels have been updated for clarification. In the variable browser, choose All Items (list) to check if any item in the array matches the criteria. |
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
The following has been updated on the Sources help topic:
|
Client Management
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The Palo Alto Networks Cortex XDR third-party integration is now available on the Integrations page. Integration with Palo Alto Networks Cortex XDR allows Cisco XDR to leverage Cortex response actions to respond to incidents or proactively mitigate threats in the following ways: add files to blocklists, quarantine or unquarantine endpoints, and perform malware scan on endpoints. This integration also creates a target automatically in Automation for out-of-box workflows. |
Third-Party Integrations |
|
Added Organization Tier Information to My Account Page |
The Organization Tier field has been added to the My Account page with the licensing tier information for your organization. For details on the licensing tiers, see Cisco XDR Licenses. |
|
|
Added Cisco XDR Essential Licensing Tier Enforcement |
All third-party integrations now require Cisco XDR Advantage or Cisco XDR Premier licensing tier. If the licensing tier for your organization is Cisco XDR Essentials, a message is displayed at the bottom of the Integrations page with additional information on how to upgrade the license or learn more about custom integrations. |
Third-Party Integrations |
Ribbon
No new customer-facing features or updates in this release.
Resources
2.3
Release Date: September 6, 2023
New Features and Updates
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Scroll Incidents Using Arrow Keys |
You can now scroll the list on the Incidents page using the up and down arrow keys on your keyboard. If the Incident drawer is open, the drawer is populated with information for the selected incident as you scroll. |
|
|
Improved Playbook Task Descriptions |
The tasks in the playbook on the Response tab in the Incident detail have been rewritten to improve useability. |
|
|
View Asset Information |
A new View asset information link has been added to the Pivot menu for device assets. When you click the link, it opens a new tab and the device information is displayed on the Device Details page. |
|
|
Help Updates |
The following help topics have been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Sync and Highlight Investigation Results |
With the sync and highlight capability, you can now easily see the associated assets, observables, and indicators in the panels when nodes are selected in the Relations Graph panel. You can also select assets, observables, and indicators in the Assets and Observables panel and the Indicators panel to highlight the nodes in the Relations Graph panel. To select multiple assets, observables, and indicators in the panels, the ctrl key (Windows) or command key (Mac) while clicking the items in the list. To select multiple nodes in the graph, press the ctrl key (Windows) or command key (Mac) while clicking the nodes or use the (missing or bad snippet) in the Graph Controls. |
|
|
Edit Saved Investigation Name in Investigation Results |
You now have the ability to edit the name of a saved investigation when viewing the investigation on the Investigation Results page. Hover over the name of the saved investigation and click the |
|
|
Updated Button to Save Investigation |
To save an investigation on the Investigation Results page, you now click Save instead of Save Investigation. In addition, when viewing a previously saved investigation, the Save button is hidden on the page. |
|
|
Help Updates |
The following help topics have been updated:
|
Intelligence
No new customer-facing features or updates in this release.
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Automation Rules |
Workflow parameter data can be hard-coded or, if the workflow has input variables, you can use the variable browser to select event input/output variables. |
|
|
Help Updates |
The following help topics have been updated:
|
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Added a note on the Sources page for device value indicating rule assigned if the value is set using a custom source. |
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated the Default Deployment screenshots on the Deployments page. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
My Account |
The My Account page is now a separate option under Administration in the navigation menu. |
|
|
Change User Role |
The Logout button is now Refresh in the popup that notifies the user if their role has been changed. |
|
|
Update Existing Third-Party Integration on Integrations Page |
The Trend Micro third-party integration has been renamed to Trend Vision One. |
Third-Party Integrations |
|
Help Updates |
The following help topics have been updated:
|
Ribbon
No new customer-facing features or updates in this release.
Resources
2.2
Release Date: August 23, 2023
New Features and Updates
Control Center
No new customer-facing features or updates in this release.
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Highlighted Text Added to Assignee Widget |
Enhancements have been made to the Assignee widget to help you quickly find the name in the search results. When you begin entering letters in the Search field, the matching letters are highlighted bold in the returned list. |
|
|
Help Updates |
The following help topics have been updated:
|
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Group Nodes Capability |
You can now group the nodes on the Relations Graph to simplify the view and reduce the noise. The grouping capability is turned on by default when the node count is 20 or higher. Nodes are grouped if they are the same type, same disposition, or have the same relationship, which means they share the same types of relationships to the same set of observables. You can turn on or turn off the grouping capability using the
|
|
|
Help Updates |
The following help topics have been updated:
|
(Group) icon and 
(Ungroup) icon in the Graph Controls on the Relations Graph.Intelligence
No new customer-facing features or updates in this release.
Automate
No new customer-facing features or updates in this release.
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Users |
Users is now available in Cisco XDR. This feature pulls user data from the Microsoft Azure Active Directory - Users third-party integration, and provides an overview of the data in a table on the new Users page in the Assets section of the navigation menu. Note: The Users feature is subject to change while in Beta. |
|
|
Add a Custom Source |
The custom source CSV upload now supports adding labels and device value to devices. |
|
|
Help Updates |
The following help topics have been updated:
|
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Upload Profile |
The Upload Profile modal has been updated to improve user experience. |
|
|
Profile Configuration |
When you create, edit, or view a profile, the Profile Configuration page now allows you to minimize and expand the sections for each setting. |
|
|
Help Updates |
The following help topics have been updated:
|
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Third-Party Integration Added to Integrations Page |
The Microsoft Azure Active Directory - Users third-party integration is now available on the Integrations page. Integrating Microsoft Azure AD with Cisco XDR provides user and device information to the Cisco XDR Assets feature and it enriches investigations and incident triage and response with device and user context. |
Integrations
Third-Party Integrations |
| Confirmed Users Page Update |
If an Administrator changes the role of an existing user and the user with the changed role is logged in to Cisco XDR, a popup message notifying the user of the change is now displayed. The user must log out of Cisco XDR and the new role is applied the next time the user logs back in. |
Users |
|
Update to Secure Access by Duo integration on Integrations Page |
The Secure Access by Duo integration has been renamed to Cisco Duo. |
Cisco Integrations |
|
New Cisco Integrations Added to Integrations Page for Asia Pacific, Japan, China Region Only |
The Secure Email Threat Defense (Australia) and Secure Email Threat Defense (India) integrations have been added to the Integrations page for the Asia Pacific, Japan, China region only. |
|
|
New Scope Added to API Clients |
A new scope (AO) has been added to the Add New Client dialog box when you click Generate API Client on the API Clients page. The AO scope is used to manage and execute Automation workflows and related objects. |
— |
|
Help Update |
Added View Users under Assets in the Roles table. |
Ribbon
No new customer-facing features or updates in this release.
2.1
Release Date: August 9, 2023
New Features and Updates
Control Center
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Update |
New screenshot showing updated navigation menu. |
Incidents
|
Feature |
Description |
Help Topic |
|---|---|---|
|
New Assets Panel in Incident Drawer |
A new Assets panel is included in the Incident drawer and is expanded by default. This panel displays the total number of unique assets through all of the events related to the selected incident. These are the same assets that are displayed in the Assets drawer on the Overview page in the Incident Details. The assets are represented by an icon that allows you to easily distinguish the asset type. Each asset includes a |
|
|
Help Updates |
Updated screenshots showing new navigation menu. |
Investigate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Customize Layout on Investigation Results Page |
You can now choose how you want the panels on the Investigation Results page to be displayed. Click the Layout button in the upper right corner of the page and choose one of the following layouts:
|
|
|
Help Updates |
Updated screenshots showing new navigation menu. |
Intelligence
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated screenshots showing new navigation menu. |
Automate
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Uninstall Workflow from Exchange |
You can now uninstall a workflow from Exchange and remove it from your tenant. |
|
|
Help Updates |
New integration targets. |
Assets
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Navigation Menu Updates |
The Devices feature has been renamed to Assets and the Inventory page has been renamed to Devices in the navigation menu. The following pages are now located under the new Assets section:
|
|
|
Add Labels to Devices |
Updated the help documentation for the Labels drawer. |
|
|
Help Updates |
New screenshots showing updated navigation menu. |
Client Management
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Navigation Menu Updates |
The Secure Client feature is now a separate section in the navigation menu. The following pages are now located under the new Client Management section:
|
|
|
Profiles Option Menu |
The Profiles page now has an Option menu where you can perform the following tasks:
Note: You cannot edit or delete default profiles. You cannot copy or download the NVM Cloud Default Profile. |
|
|
Deployments Page Enhancements |
The following enhancements have been added to the Deployments page:
|
|
|
Help Updates |
New screenshots showing updated navigation menu. |
Administration
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Updates to Cisco integrations on Integrations Page |
The following integrations have been renamed to align with the rebranding initiative:
|
|
|
Help Updates |
The following is a list of Help updates for this release:
|
Ribbon
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help Updates |
Updated screenshots to align with the Orbital app UI. |
2.0
Release Date: July 26, 2023
This is the general availability release of Cisco XDR.