Release Notes for Cisco XDR 2.67

Release Date: June 10, 2026

New Features and Updates

Note: Only sections with new customer-facing features or updates in this release are listed below.

Getting Started

Feature	Description	Help Topic
Help update	Updated the What's Next section in the Getting Started topic to include the Detections and Activities features.	Getting Started

Incidents

Feature	Description	Help Topic
Incident ID added to the Incidents page	The new ID column on the Incidents page now displays the unique short identification number, with an INC prefix, to reference the incident. The number is only unique within the current organization. You can search or sort by ID number. The ID is also displayed in the incident drawer and the incident detail header. Note: The ID is not available for incidents that were created prior to March 4th, 2026.	Incidents Incident Detail
Last Activity column added to Incidents page	The new Last Activity column has been added to the Incidents page. It displays the date and time the current incident was updated by the system based on new or updated detections. The Last Activity is also displayed in the incident drawer.	Incidents Incident Detail
Modified column renamed to Last Updated on Incidents page	The Modified column has been renamed to Last updated on the Incidents page. The column is optional and can be selected in the Table Settings drawer.	Incidents
Investigated events in Detection tab	Investigated events are no longer generated for incidents and will not appear for new incidents in the Detection tab on the Incident Detail page.	Detection Incident Detail with AI Analysis Incident Detail Navigate Cisco XDR
Incident detail with AI analysis updates	The following updates have been made to the incident detail with AI analysis page: The View support details link in the upper right corner has been moved to the new (Options) icon as a Support details menu option next to the incident name. The Return to classic view button in the upper right corner has been renamed to Classic view. The Impact panel has been removed from the left pane and the Information icon that opens a confidence factors popup next to the confidence tags have been removed to streamline and optimize the view. Any feedback provided by users on the accuracy of the AI analysis for the incident is now displayed in the Worklog tab in incident detail and incident detail with AI analysis.	Incident Detail with AI Analysis Worklog Incident Detail
Help update	Updated the Detections topic with a note indicating that if Cisco Secure Endpoint does not provide network interfaces, these Secure Endpoint detections may not be part of an incident.	Detections

Investigate

Feature	Description	Help Topic
Filters drawer update on Activities page	You must now enter the full and exact IP address (IPv4 or IPv6) in the Source IP and Destination IP fields in the Filters drawer on the Activities page. To filter for multiple IPs, separate each address with a comma.	Activities

Automate

Feature	Description	Help Topic
Share workflow run results with others efficiently.	You can now generate an AI summary for completed workflow runs, helping you quickly understand workflow results without reviewing every action in detail. The run summary is available from the run drawer and supports workflow runs that include sub-workflows or atomic workflows. In the run view drawer, click Generate Run Summary, when completed the summary is available within the drawer.	Workflow Editor View, Filter, and Search for Runs
Improved Exchange workflow installation errors	Updated Exchange workflow installation errors to provide clearer, actionable details when installation fails because of configuration issues. The error details now appear on the Exchange page and the run's view details page when the workflow installation status is Import Failed. Links to additional information are provided when available.	Exchange

Feature

Description

Help Topic

Share workflow run results with others efficiently.

You can now generate an AI summary for completed workflow runs, helping you quickly understand workflow results without reviewing every action in detail. The run summary is available from the run drawer and supports workflow runs that include sub-workflows or atomic workflows.

In the run view drawer, click Generate Run Summary, when completed the summary is available within the drawer.

Workflow Editor

View, Filter, and Search for Runs

Improved Exchange workflow installation errors

Updated Exchange workflow installation errors to provide clearer, actionable details when installation fails because of configuration issues. The error details now appear on the Exchange page and the run's view details page when the workflow installation status is Import Failed. Links to additional information are provided when available.

Exchange

Assets

Feature	Description	Help Topic
Seen in sources card added to User Details page	The Seen is sources card has been added to the User Details page. This card displays the Cisco Identity Intelligence sources that provided the user data. Click the source name to open a drawer that contains all the user data provided by that source.	User Details

Client Management

Feature	Description	Help Topic
Endpoint Visibility Module version update	Endpoint Visibility Module version 1.7.1.11 has been released. This release includes fixes for an issue in the reporting of HTTP requests that use uncommon HTTP methods, and fixed an incompatibility with a forthcoming version of the Cloud Management module.	Deployments Endpoint Visibility Module in Cisco XDR

Feature

Description

Help Topic

Endpoint Visibility Module version update

Endpoint Visibility Module version 1.7.1.11 has been released. This release includes fixes for an issue in the reporting of HTTP requests that use uncommon HTTP methods, and fixed an incompatibility with a forthcoming version of the Cloud Management module.

Deployments

Endpoint Visibility Module in Cisco XDR

Integrations

Feature	Description	Help Topic
Help update	Updated the Secure Endpoint Integration topic with a note indicating that if Cisco Secure Endpoint does not provide network interfaces, these Secure Endpoint detections may not be part of an incident.	Secure Endpoint Integration

Previous Release Notes

To view the Release Notes for previous releases, see Previous Release Notes for Cisco XDR.