Release Notes for Cisco XDR 2.67
Release Date: June 10, 2026
New Features and Updates
Note: Only sections with new customer-facing features or updates in this release are listed below.
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Help update |
Updated the What's Next section in the Getting Started topic to include the Detections and Activities features. |
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Incident ID added to the Incidents page |
The new ID column on the Incidents page now displays the unique short identification number, with an INC prefix, to reference the incident. The number is only unique within the current organization. You can search or sort by ID number. The ID is also displayed in the incident drawer and the incident detail header. Note: The ID is not available for incidents that were created prior to March 4th, 2026. |
|
|
Last Activity column added to Incidents page |
The new Last Activity column has been added to the Incidents page. It displays the date and time the current incident was updated by the system based on new or updated detections. The Last Activity is also displayed in the incident drawer. |
|
|
Modified column renamed to Last Updated on Incidents page |
The Modified column has been renamed to Last updated on the Incidents page. The column is optional and can be selected in the Table Settings drawer. |
|
|
Investigated events in Detection tab |
Investigated events are no longer generated for incidents and will not appear for new incidents in the Detection tab on the Incident Detail page. |
|
|
Incident detail with AI analysis updates |
The following updates have been made to the incident detail with AI analysis page:
|
|
| Help update |
Updated the Detections topic with a note indicating that if Cisco Secure Endpoint does not provide network interfaces, these Secure Endpoint detections may not be part of an incident. |
Detections |
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Filters drawer update on Activities page |
You must now enter the full and exact IP address (IPv4 or IPv6) in the Source IP and Destination IP fields in the Filters drawer on the Activities page. To filter for multiple IPs, separate each address with a comma. |
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Share workflow run results with others efficiently. |
You can now generate an AI summary for completed workflow runs, helping you quickly understand workflow results without reviewing every action in detail. The run summary is available from the run drawer and supports workflow runs that include sub-workflows or atomic workflows. In the run view drawer, click Generate Run Summary, when completed the summary is available within the drawer. |
|
|
Improved Exchange workflow installation errors |
Updated Exchange workflow installation errors to provide clearer, actionable details when installation fails because of configuration issues. The error details now appear on the Exchange page and the run's view details page when the workflow installation status is Import Failed. Links to additional information are provided when available. |
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Seen in sources card added to User Details page |
The Seen is sources card has been added to the User Details page. This card displays the Cisco Identity Intelligence sources that provided the user data. Click the source name to open a drawer that contains all the user data provided by that source. |
|
Feature |
Description |
Help Topic |
|---|---|---|
|
Endpoint Visibility Module version update |
Endpoint Visibility Module version 1.7.1.11 has been released. This release includes fixes for an issue in the reporting of HTTP requests that use uncommon HTTP methods, and fixed an incompatibility with a forthcoming version of the Cloud Management module. |
|
Feature |
Description |
Help Topic |
|---|---|---|
| Help update |
Updated the Secure Endpoint Integration topic with a note indicating that if Cisco Secure Endpoint does not provide network interfaces, these Secure Endpoint detections may not be part of an incident. |
Previous Release Notes
To view the Release Notes for previous releases, see Previous Release Notes for Cisco XDR.