Release Notes for Cisco XDR 2.40

Release Date: April 16, 2025

New Features and Updates

No new customer-facing features or updates in this release.

Feature

Description

Help Topic

Help updates

The following updates have been made to the Help:

  • Updated the Secure Endpoint Configuration Insights section in the MITRE ATT&CK® Coverage Map topic to improve readability.

  • Updated the MITRE ATT&CK® Coverage Map topic with a new screenshot in the Secure Endpoint Policy Drawer section to align with the UI.

 MITRE ATT&CK® Coverage Map

Feature

Description

Help Topic

Help update

The following update has been made to the Help:

  • Updated screenshot in Incidents topic to align with the UI.

Incidents

Feature

Description

Help Topic
Help updates

The following updates have been made to the Help:

  • Updated the screenshots in the Investigate and Saved Investigations topics to align with the UI.

Investigate

Saved Investigations

No new customer-facing features or updates in this release.

Feature

Description

Help Topic

Request Approval task activity

Both the Create Approval Request and Wait For Event task activities, deprecated since release 2.36, have now been removed from Automation. Workflows using these obsoleted activities will fail. Please replace them with the Request Approval task activity.

Task Activities

Request Approval Task

Automation Remote

On May 31, 2025, Ubuntu 20.04 LTS will reach the end of its standard five-year support window. Your existing Remote configuration will continue to work. However, we recommend that you redeploy your Remote VM with our updated 6.40.0 OVA to maintain support using the newer Ubuntu 24.04 LTS. Refer to the instructions in the Automation Remote Help topic.

Automation Remote

Rate limits

To preserve system resources and ensure the integrity and performance of the platform, Automation rate limits have been updated. Refer to the Webhook API in the Workflows Help topic.

Workflows

Help update

The following additional update has been made to the Help:

  • Renamed the Cohesity Data Cloud target to Cohesity DataProtect in the Targets Created From Integrations Help topic.

Targets Created From Integrations

Feature

Description

Help Topic

Bulk action bar

A bulk action bar has been added to the Devices and Users page. Use this bar to update values and labels for one or more devices or users at the same time.

Devices

Users

Help updates

The following updates have been made to the Help:

  • Reorganized multiple sections in the Devices and Users topics for the bulk action bar update.

  • Updated the screenshots in the Devices topic to align with the UI.

Devices

Users

Feature

Description

Help Topic

Bulk action bar

A bulk action bar has been added to the Clients page. Use this bar to move multiple devices to a different deployment at the same time.

Clients

Zero Trust Access profile

You can now upload a Zero Trust Access profile to the Profiles page and select a Zero Trust Access profile when creating new deployments.

Profiles

Profile Configuration

Create Deployment

Deployments page

The Deployments page now has tabs to separate the Default Deployments and Custom Deployments.

Deployments

Help updates

The following updates have been made to the Help:

  • Updated the Move to Deployment section in the Clients topic.

  • Added Zero Trust Access to the Secure Client Profiles section of the Profile Configuration topic.

  • Added Zero Trust Access profile selection to the Create Deployment topic.

  • Updated the screenshots in the Clients, Deployments, and Create Deployment topics to align with the UI.

Clients

Profile Configuration

Create Deployment

Deployments

Feature

Description

Help Topic

API Clients page

The (View) icon has been removed from the Actions column on the API Clients page and you can now click the API client link in the list to view details of the API client.

API Clients

Feature

Description

Help Topic

Microsoft Defender for Office 365 GCC update

The Microsoft Defender for Office 365 GCC application in Microsoft Government Community Cloud (GCC) integration on the Integrations page now supports threat hunting and investigation capability. Use the Microsoft Defender for Office 365 GCC integration to search for security detections and associated indicators, reputations, and references, involving specified email addresses, URLs, email subjects, message IDs, IPs, file names, or SHA-256 hashes.

Cisco and Third-Party Integrations and Supported Capabilities

Help updates

The following updates have been made to the Help:

  • The Have I Been Pwned integration has been tested and certified by Cisco Quality Assurance labs and it has been added to the Cisco and Third-Party Integrations and Supported Capabilities topic as supported third-party integration in Cisco XDR.

  • The following integration topics have been added to the Cisco XDR help: Secure Firewall Integration, AbuseIPDB IPChecker Integration, AlienVault Open Threat Exchange Integration, MISP Integration, Check Point Quantium Smart-1 Cloud Integration, and Proofpoint Threat Protection Integration. The links to the topics have been added to the Cisco and Third-Party Integrations and Supported Capabilities topic.

Cisco and Third-Party Integrations and Supported Capabilities

Have I been Pwned Integration

Secure Firewall Integration

AbuseIPDB IP Checker Integration

AlienVault Open Threat Exchange Integration

MISP Integration

Check Point Quantum Smart-1 Cloud Integration

Proofpoint Threat Protection Integration

No new customer-facing features or updates in this release.

No new customer-facing features or updates in this release.

Previous Release Notes

To view the Release Notes for previous releases, see Previous Release Notes for Cisco XDR.