Hello, and thank you for watching this tool success capsule. Today we will cover checks and Cisco identity intelligence. My name is Sheila Vida and I am a security customer success specialist.00:05In this capsule, we will briefly define what Cisco identity intelligence does, but focus on the checks which are the heart of CIA. We will then do a quick demo and then leave you with some tidbits a summary.00:20Cisco identity intelligence is a security platform which ingests identity information and more from multiple data sources, whether that's information and attributes from your identity providers, your connected applications like your HRI assistance.00:37An information around your devices, your applications, and live threat feeds. You could even feed it static information stored in text files, e.g.. This information are then sent into our posture management and threat detection and response engine.00:55And checks, which is what we will cover in detail today, highlights, insights from those processing to surface things that you need to act on. That information can then be sent to the mechanism which.01:13Prompts you to take action, whether that's integration to other Cisco security solutions, your notification systems, instant messaging platforms, or other mitigation and remediation solutions that you have in your environment.01:30At the heart of CIAI is what's called an identity graph, and this provides cross platform insights around your environment. It finds the connection between the user elements, the machines, the services, and other systems that are connected in your environment as.01:47Integrated to CIA.02:07Find relationships among them and then surface possible posture or threat detection in your environment that will then be sent to your notification for you to improve on. There is a separate success capsule focused on the.02:09Introduction to CII along with you.02:29Other components which are involved with the process and you recommend that you check it out in addition to this capsule. Today the focus of the capsule is around checks, and the checks page provides high level information on all the checks across all the users in your environment.02:32And this allows you to quickly understand the state of your environment and assess potential areas in need of attention. So this is what the checks page looks like and during the demo we will.02:52Click on some of these elements to see how to navigate this better. This page is what's called a check results page and we will see the anatomy of what the resultant of running a check is.03:06On the demo as well. So let's get that started. When you log into CII, you start with a dashboard page like this and let's go to the checks page, and that was the.03:22Patient we were looking at earlier, you do have a list of your checks and checks are ordered based on the compliance. So the lower compliance, the higher it's going to be, and then the number of failing users next. So you can see that that's how it was ordered there. And then the checks listed are based on what integrations are set up.03:40In your environment. So this is a second instance, I only have four integrations and I have fewer checks for that. So let's go back to this page. We do have multiple filters around compliance, severity, and topics like topics are the type of checks. So this we're looking at posture checks and then.04:00You could also filter by the identity threat inside checks or checks related to non human identities.04:20So recommend selecting a filter to focus on the check that you want to look at. And you also did see there the compliance factors, compliance, sorry, frameworks that a check would be linked to.04:30If there's a check that you don't see here that you want us to take a look at, you could click that check request button. Alright, now let's double click on one check here and let's select this NO MFA configured one. So inside a check will be the detail of what that check does, when its last run.04:46What topics or categories it's part of and what frameworks it addresses along with what sources it's compatible with.05:06And what actions are recommended when a user is failing a check, which is the list here. So you see here the list of the failing users and if you wanna investigate further, click on an empty space next to the user and it will open up the more information for that check failing.05:14From here, you could then either view the logs further, exclude a user from a check or send notification for that user. You can also customize a check such as setting a grace period, e.g., this particular check is around the NO MFA configured, so let's say you know that you are.05:33Your your onboarding process is around 14 days. There might be users that still don't have MFA at that point so you could do that customization around this area here.05:53You could also put an ignore list if there's a particular group of users that you know, will not need the MFA so the check will not keep on flagging it. Moving on, you could configure notification, targets, your.06:05Slack, let's say you do have Slack for notification or emails, that's where you can figure it here. We also have sort of like a mini widget associated with this check. This is different depending on the check, but, just giving you a quick view of the number of failing users.06:21There's for for this particular one around NO MFA configured and having a breakdown per integration and per user type.06:41Right, and let's go back to that checks page one more time because that is going to be our starting point whenever, whenever we start looking at checks. Right.06:56Now let's wrap this capsule up with three tidbits. The 1st one we have mentioned that on the checks page, the checks are actually sorted from the one which is the least compliance, so the the smaller the compliance score means a lot of.07:16Users are kind of like failing that check, so that goes 1st. And then the next, the next metric is large impacts. So the the number of failing users is evaluated next. So we recommend checking.07:34The recommended ordering to look at the most impactful failing checks 1st. The next, tidbit that we wanna leave you with is to use filters to focus on a particular insight. We did see the concept of the topics so if you want to take a look at.07:50Your checks which are failing on the compliance topic.08:10Do that filter and you can also further drill down depending on the identity source, so use a combination of those filters to focus your view of the the insights which are highlighted by the failing checks. And then lastly, depending on the check, you could customize it for your setup. We.08:13You're looking at the NO MFA configured. If let's say the example we have there, you have an onboarding time frame that you know users will be failing that particular check to minimize the noise. Try to configure it to your environment and link it to your notification targets, so you're automatically notific.08:33Find whenever a failing check is reported. Thank you for joining us for the success capsule. Have a good one.08:53
