Release Notes for Cisco XDR 2.74

Device details added to detection details page

The Device details area has been added to the detection details page. It displays available information about the device associated with the current detection, including details from Assets when a matching device is found, as well as information reported by the source product.

New activity details added to Activities page

The following attributes have been added to the activity details drawer and as optional columns in the activities table:

• Source endpoint

  • Source instance UID

  • Source VPC UID

  • Source subnet UID

  • Source service name

  • Source zone

• Destination endpoint

  • Destination instance UID

  • Destination VPC UID

  • Destination subnet UID

  • Destination service name

  • Destination zone

• Connection

  • TCP flags

  • Boundary

• Cloud

  • Cloud provider

  • Cloud account ID

  • Cloud region

  • Cloud zone

Help update

Updated the Profile Configuration topic to clarify that uploading a raw VPN profile XML imports only settings supported by the profile editor. Unsupported, deprecated, default-valued, or context-dependent fields might not be preserved in the generated XML.

Asset status notifications improve response readiness

XDR Forensics can now notify teams when a Responder-backed asset becomes Unreachable or Unmanaged, based on preferences configured in Notification Settings. These notifications help analysts identify coverage gaps before starting evidence collection or response tasks.