Release Notes for Cisco XDR 2.52

New Evidence page added to incident detail for XDR Forensics

You can now acquire and view forensic data from assets within an incident and connect to the assets using a remote shell for remediation purposes in the new Evidence tab in incident detail. The data varies based on the asset and the acquired data can be used for further analysis and investigation in the XDR Forensics UI.

The Evidence tab is only available for customers with Cisco XDR Advantage or Cisco XDR Premier licensing tier.

Prior to acquiring forensic evidence for an incident for the first time, you must have a Secure Client deployment with the XDR Forensics module enabled and installed on your endpoints. For more information, see Create Deployment.

All the acquisition and remote shell statuses from XDR Forensics are now displayed in the Worklog tab.

Actuator value added to playbook tasks

The Actuator value for an Automation workflow is now displayed in the task drawer and the New Task drawer on the Playbooks page, if applicable.

XDR Forensics

The XDR Forensics feature (Investigate > Forensics) is now available for Cisco XDR Advantage or Cisco XDR Premier licensing tier customers.

XDR Forensics is an automated investigation and response platform that delivers deep forensic visibility and end-to-end investigation capabilities at speed. XDR Forensics combines the rapid remote acquisition of 698 evidence types with intelligent, efficiency-driven automation to drastically reduce investigation time, simplify workflows, and empower SOC and incident responders with accurate, collaborative insights, thereby boosting long-term cyber resilience.

Related incidents added to Detection Findings table and drawer

The new Related incidents column and field has been added to the detection findings table and drawer in the Detection Findings tab on the Investigate page. It displays all the current incidents that contain the security event.

New tables for workflow variables in the properties panel

Within the Workflow Editor, the Workflow Properties panel is being improved. To make the Variables section more intuitive and efficient to use, the variables are now grouped and listed in separate tables:

• Input variables

• Output variables

• Local and static variables

This updated format makes it easier to quickly identify and find the variables.

The Scope column would be redundant in the input and output variables tables, so it’s been removed to free up space for other information.

Now the variables are listed alphabetically within their tables. The order of the variables is retained when execution of the workflow is initiated and in the JSON when the workflow is exported.

To delete a variable from its table, hover over the row of the variable and click the trash can icon.

Default targets

Added a new Custom Security Events APIs target.

Integration targets

Added a new Microsoft Sentinel integration target.

Atomic actions

Added three new atomic actions:

• Microsoft Sentinel - Get Incident by ID

• Microsoft Sentinel - Get Table Schema

• Microsoft Sentinel - List Incidents

• Microsoft Sentinel - Run Query

• Microsoft Sentinel - Send JSON Event for Ingestion

FQDN added to Devices table

The FQDN (fully qualified domain name) is now an available column in the Devices table. Click the (Settings) icon to open the Select columns drawer and check the FQDN check box to display the column in the table. This data is usually provided by the Orbital or Secure Endpoint integrations.

Used devices update

Devices included in the Used Devices column in the Users table, the Devices section of the User Details drawer, and the Devices card on the User Details page now open the Device Details drawer to provide a summary of the selected device’s information.

New XDR Forensics profile and module

The XDR Forensics profile is now included as a default profile for Cisco XDR, and the XDR Forensics module is now available for deployments. XDR Forensics enables you to acquire forensic data and launch a remote shell from assets within an incident.