Release Notes for Cisco XDR 2.77

Release Date: October 28, 2026

New Features and Updates

Note: Only sections with new customer-facing features or updates in this release are listed below.

Automate

Feature	Description	Help Topic
Atomic actions	Added three new atomic actions: AWS S3 - Amazon Web Services S3 AWS SNS - Amazon Web Services SNS AWS SQS - Amazon Web Services SQS	Atomic Actions
Help update	Replaced the list of atomic actions with a link to the current list maintained on the Built-in actions page at Cisco XDR.	Atomic Actions

Feature

Description

Help Topic

Atomic actions

Added three new atomic actions:

AWS S3 - Amazon Web Services S3
AWS SNS - Amazon Web Services SNS
AWS SQS - Amazon Web Services SQS

Atomic Actions

Help update

Replaced the list of atomic actions with a link to the current list maintained on the Built-in actions page at Cisco XDR.

Atomic Actions

Assets

Feature	Description	Help Topic
Cisco XDR on-premises device data	Cisco XDR is now a supported source for Devices. The Cisco XDR source ingests on-premises device data from Detections. The devices come from your on-premises network sources, which can include the Cisco XDR sensor, Cisco Meraki, and more. To enable this source, go to Assets > Sources, then click the (Open Settings) icon in the Cisco XDR source card and enable the Data ingestion toggle.	Devices Sources

Feature

Description

Help Topic

Cisco XDR on-premises device data

Cisco XDR is now a supported source for Devices. The Cisco XDR source ingests on-premises device data from Detections. The devices come from your on-premises network sources, which can include the Cisco XDR sensor, Cisco Meraki, and more.

To enable this source, go to Assets > Sources, then click the (Open Settings) icon in the Cisco XDR source card and enable the Data ingestion toggle.

Devices

Sources

Client Management

Feature	Description	Help Topic
Endpoint Visibility Module version 1.9.2.7 release	Endpoint Visibility Module (EVM) version 1.9.2.7 has been released for Windows deployments. This release fixed an issue (CDETS: CSCwx41720) that could prevent EVM for Windows from starting correctly on endpoints using certain system locales, causing telemetry loss and potentially reducing visibility into some incidents. To upgrade affected endpoints, update your Client Management deployments to use EVM 1.9.2.7 or later.	Deployments Endpoint Visibility Module in Cisco XDR

Feature

Description

Help Topic

Endpoint Visibility Module version 1.9.2.7 release

Endpoint Visibility Module (EVM) version 1.9.2.7 has been released for Windows deployments. This release fixed an issue (CDETS: CSCwx41720) that could prevent EVM for Windows from starting correctly on endpoints using certain system locales, causing telemetry loss and potentially reducing visibility into some incidents. To upgrade affected endpoints, update your Client Management deployments to use EVM 1.9.2.7 or later.

Deployments

Endpoint Visibility Module in Cisco XDR

Administration

Feature	Description	Help Topic
Cloud detections added to Native Detections	Cloud detections are now available to view and configure on the Native Detections page. Cloud alerts from Secure Cloud Analytics are being migrated to Cisco XDR. As part of the transition, some cloud detections have been renamed. For more information, see the Detection Migration Guide. Note: The cloud detection migration is planned for November 4, 2026. If the expected migration date changes, customers will be notified by email.	Native Detections
Help updates	Added information to the Incident Tuning topic about the 100-rule tenant limit and how detection updates affect the incident action and applied rule.	Incident Tuning

Feature

Description

Help Topic

Cloud detections added to Native Detections

Cloud detections are now available to view and configure on the Native Detections page. Cloud alerts from Secure Cloud Analytics are being migrated to Cisco XDR. As part of the transition, some cloud detections have been renamed. For more information, see the Detection Migration Guide.

Note: The cloud detection migration is planned for November 4, 2026. If the expected migration date changes, customers will be notified by email.

Native Detections

Help updates

Added information to the Incident Tuning topic about the 100-rule tenant limit and how detection updates affect the incident action and applied rule.

Incident Tuning

Integrations

Feature	Description	Help Topic
Amazon Web Services applications added to Integration page	The Amazon S3, Amazon SNS, and Amazon SQS applications have been added to the Amazon Web Services integration. These applications enable support for atomics and workflows in Automate.	Cisco and Third-Party Integrations and Supported Capabilities Amazon Web Services Integration
Help updates	The following updates have been made to Help: Updated the Security Operations Center (SOC) Automation column from No to Yes for the Amazon Web Services integration in the Cisco and Third-Party Integrations and Supported Capabilities topic. Added workflows information to the What's Next section in the Microsoft Sentinel Integration topic.	Cisco and Third-Party Integrations and Supported Capabilities Microsoft Sentinel Integration

Feature

Description

Help Topic

Amazon Web Services applications added to Integration page

The Amazon S3, Amazon SNS, and Amazon SQS applications have been added to the Amazon Web Services integration. These applications enable support for atomics and workflows in Automate.

Cisco and Third-Party Integrations and Supported Capabilities

Amazon Web Services Integration

Help updates

The following updates have been made to Help:

Updated the Security Operations Center (SOC) Automation column from No to Yes for the Amazon Web Services integration in the Cisco and Third-Party Integrations and Supported Capabilities topic.
Added workflows information to the What's Next section in the Microsoft Sentinel Integration topic.

Cisco and Third-Party Integrations and Supported Capabilities

Microsoft Sentinel Integration

XDR Forensics

Feature	Description	Help Topic
Case Dashboard provides a live and versioned investigation view	The Case Dashboard is now the home view of a case, bringing assets, evidence, findings, flags, tasks, activities, and participants into one always-available view. When a case is closed, XDR Forensics preserves a snapshot for post-incident review and reporting.	Using the Investigation Hub
Evidence Repository management moved into Repository Explorer	Repository Explorer is now the primary place to view, create, edit, and manage evidence repositories. Analysts and administrators can move from repository configuration to repository browsing with fewer context switches.	Repository Explorer
Policies are easier to access and manage	Policies now appear as a standalone sidebar entry. Stale Asset Policies and Removal History are also grouped under Policies, improving navigation for teams that rely on policy-driven asset lifecycle management.	Policies
Hunt/Triage rule organization is improved for TAXII and STIX content	TAXII-generated Hunt/Triage rules can now create tags from STIX indicator labels, and rule selection grids display tags. This helps analysts understand rule context and select relevant detections faster.	Hunt/Triage
Windows Event Log collection coverage is expanded	XDR Forensics adds and refines default Windows Event Log records coverage across commonly investigated channels, including ESENT, AppLocker, SMBClient, Sysmon, TaskScheduler, and Windows Defender.	Windows Event Records and How They Are Handled

Previous Release Notes

To view the Release Notes for previous releases, see Previous Release Notes for Cisco XDR.