Release Notes for Cisco XDR 2.34

Team Mean Time Summary tile and User Mean Time Summary tile updates

Updated the descriptions for the Team Mean Time Summary tile and the User Mean Time Summary tile due to the new incident statuses.

New incident statuses are now available for all incidents. The new statuses align with industry standards and they provide additional details on the nature of the incident. For a list of the available incident statuses, see Available Statuses.

For compatibility purposes, the previous incident statuses (Open, Closed, Incident Reported, Containment Achieved, Stalled, Rejected, and Restoration Achieved) are available in the Filters drawer only. You cannot set an incident to one of these statuses.

Hide Closed Incidents

The previous Include Closed Incidents toggle is now a Hide Closed Incidents check box on the Incidents page and in the Filters drawer. You can uncheck the Hide Closed Incidents check box to display closed incidents in the Incidents list.

Clear button added to Filters drawer

You can now click the new Clear button to remove your selections in the Status and Assignment drop-down lists in the Filters drawer.

New variables for observable state

Two new variables have been added to enable a content author to set the state of observables in their incident response workflows that are intended for use by playbook tasks. In the Set Variables activity within a For Each loop, open the variable browser, search or navigate to choose Result Message (string) and Succeeded (true or false), and enter their values.

Set workflow result variables

When it comes to defining variables within a workflow, you can use the Workflow Result variables to provide information about the workflow’s execution. In particular, the Workflow Result Code variable is an auto-populated string - the system derives the value based on the observable state or workflow result - that indicates the outcome of the workflow.

Now you also have the option to override and explicitly set the code by choosing a value from the list as needed. If you choose Completed Successfully to override Partially Completed in a completed workflow where at least one of its observable tasks did not succeed, the task workflow shows Complete in the incident playbook's Response tab and the Workflow Result variable's value is shown in the corresponding Worklog tab. View the workflow’s run details and you can see the values of both Workflow Result variables in the Output section.

Improved health checks

Improved health checks have been added to ensure that Automation rules are executing as expected. Users are notified if rate limits are exceeded.