Cisco IQ Fundamentals: Activate Cisco IQ

Welcome everyone to our expert insight series session on activating Cisco IQ.00:09This is the 1st step in realizing the value of a unified AI powered digital experience that will transform how you manage, secure, and optimize your IT infrastructure. We're fortunate to have Michael Marquie, our services account executive and IQ expert leading us today. Thanks Michael. Please use the Q.00:16Q and A at the bottom right, if you have questions during the session, if we don't get a chance to answer all of the questions, you are welcome to go on onto our communities to get them answered. There'll be a QR code at the end of the session if you don't know how to get to our communities. So thanks again for joining and the floor is yours Michael.00:36Thank you so much Michelle. Hi, everybody. My name is Michael Marky, and the 1st thing I would like for everybody to do is go ahead and go to iQ.cisco.com. And what we're gonna do is have you activate your free Cisco IQ account. So go to iQ.cisco.com.00:56And you can do that now and log in with a valid cco ID. So type in your CCO ID and you'll be able to log in. Once again, iQ.cisco.com. Once you've typed in your cco ID, you should see a screen that looks similar to this.01:15Where you're gonna actually create your IQ account. So put in your company name or choose it and then select your region. Please make sure to select the correct region where, your geographic data center is.01:34If you have a Cisco CX Cloud account, you are most likely already automatically migrated to Cisco IQ. But in case you weren't migrated, you may see this screen here. It's important to note that you won't get a chance to migrate your CX cloud CX Cloud account later.01:51So please take the time if you do this, see this screen to migrate that account. So fill in the information and then click create account and migrate data. So please go ahead and log in and create your free Cisco IQ account.02:10Meanwhile, I am going to switch over to oops, our live demo. Here we go, and welcome to Cisco IQ. So in case you're not familiar with Cisco IQ, Cisco IQ is our life cycle management tool set.02:28It comes along with a lot of AI backends that are built in. Now, when we talk about AI, there's a lot of different things we could be talking about. And there's a lot of different AI functions that we're utilizing through Cisco IQ to help our customers have greater visibility of their Cisco assets and to be able to keep up with at scale.02:46Feel a lot of the issues that can be facing those assets. So within CX cloud, I'm sorry, within Cisco IQ, we have got an LLM.03:06Large language model where you can ask questions and generate custom reports and dashboards. But we've also got a connection to the Cisco TAC database. This is a large database of all the TAC information we've been pulling for years, all the cases that we've solved, all the cases that we see on things.03:17Like P certs and CVEs, and we've got AI agents that run against that database. And those agents are pulling out what we call insights. They're looking for common factors that we see across environments.03:37And we're then comparing those to your individual unique systems and those configurations. So we can be able to tell you what we actually think is going on within your assets and environment. All of this is powered through telemetry.03:51And so, you would go in and go to system settings and you can connect in your devices through telemetry. We've got a number of data connectors, so you can plug in your cloud instances into Cisco IQ through the use of an API key.04:09You can utilize legacy collectors such as the CX Cloud agent and the CSPC collector. But I would recommend taking a look at our newest agent, which is the Cisco IQ link. And when you're in Cisco IQ.04:26You can actually come here and you won't see it on my demo environment, but in your live environment, you will see a download link to get Cisco IQ link. And we do have documents and guides for how to set this up.04:43But you can use that to set up your telemetry, which gives us a live look at your systems and their configurations. I'm gonna go back to the homepage and I'm gonna show the Cisco support tiers.04:58So Cisco IQ is delivered through Cisco support and we have three main flavors of support that we offer. Basic, standard, and signature, Whereas I call them good, better, and best.05:13Each one of these support levels is going to offer different features within Cisco IQ. And so we've got here a list of all the features that each level offers available to you when you log into Cisco IQ. So if you're not seeing something that you saw in this demo and you're wondering why, you can go ahead.05:30And check and see, do you have the correct support level to get that feature?05:50And for customers who are running basic, we now offer a quick start, which will give you access to standard level support for for a full year before having to jump into, actually buying standard regularly on your assets. It's important to note that this is done on an asset.05:55By asset basis, meaning you can choose what support best fits your asset. Say you've got production devices and you want to run standard because you want to see some of the higher level assessments. You can do that and you can run basic in your test dev environment where maybe you don't need that type of access. So the.06:15There's NO requirement to have, you know, fully standard or fully signature. You can mix and match to match what you need from that individual asset.06:35We offer a large number of dashboards to go along with Cisco IQ and I'll show you later how you can customize your own unique individual dashboards. But you can come into dashboards and here we're looking at the last date of support dashboard.06:49So you can get important information about last date of support, and I'll talk a little bit more about that later. We also offer peer benchmarking dashboards in case you want to compare yourself against kind of a conglomerate of peers, within your industry.07:03And see how you stack up compared to them. Here we've got the landing page for Cisco IQ. This is probably the 1st thing you're gonna see upon logging in. And you won't see it in my version because it's the live demo, but in the production.07:19Production version, there will be some buttons and features here for you to import contracts, import your devices.07:39Activate telemetry, connect your cloud connectors, all the things you're going to need to be able to do in order to start seeing information populate within Cisco IQ. So I recommend taking a look at that when you log in and start connecting. So you can start getting that data so we can start bringing.07:48And the value out of Cisco IQ. Okay.08:08So IQ is across kind of three different platforms, assets, assessments, and support. And I'm gonna start off this demo by going through assets. So I go ahead and click on assets, and here we've got an overview of all your Cisco assets. So, hey, here's.08:11What's covered by service contracts, here's what I'm looking at from last date of support standpoint. Okay, I've got 47 % of my assets that have a critical or high security advisory. I probably want to look at that. So a number of dashboards that you can kind of look at to get an overall feel for how your Cisco environment looks.08:31I'm gonna go ahead and click on inventory. And here you're going to see a detailed listing of all your Cisco devices. And this can be pretty overwhelming, so we offer a large set of filters that you can use to organize this information. So I'm gonna come here.08:51And click on filters. And here you'll see a lot of different filters. So we've got product type, product family, I always like to click into this one just to show.09:10How many products we have under Cisco IQ? I mean, we've got a whole bunch of stuff in here, including some phones, and we're adding new products every time we do a release. We intend to cover the entire Cisco portfolio through Cisco IQ.09:19Some other important things you can sort by contract number, coverage in case you're wondering what support level you have. You can sort by telemetry or last signal date. When is Cisco IQ getting information from my devices? Do I have telemetry set up with my devices?09:36Or do I need to go take a look at that and make sure we're getting live information from that device?09:56You can also do last day to support filters. So hey, I wanna see what's coming up last day to support in the next twelve months. And I'm gonna show you a custom report that kind of dives into this a little bit more, but this is an excellent way for you to organize going into your financial budgetary meetings for the next year to.10:03To create reports for management that say, this is what's coming last date of support, and this is what we need to replace or refresh.10:21So I said I would show you how to create some custom reports and I'm gonna go ahead and do that now. So I'm gonna come up to the ask AI button, and ask AI is our large language model. Here you can ask any number of custom questions that you may have, and get back customized dash.10:34Towards customized presentations, customized Excel sheets, all sorts of great information.10:54I'm not gonna do a live question today, but it does work for live questions, but instead I'm going to use a prompt, and I'm gonna go in and choose assets, and I'm gonna ask it to summarize my assets reaching the last date of support in the next twelve months.11:00So I go ahead and click on that, and it's going to think for a minute, and here we go. Alright, here's a quick summary of all my products that are reaching last date of support, and here's an Excel spreadsheet of all those devices.11:16But what's really cool is I can go ahead and click on analyze response. What this is gonna do is it's going to utilize AI to create dashboards, give you insights into what's most important to replace. It's going to generate all the information you may need for a management report.11:31When it comes to your budgetary cycle for LDOS and when it's done, and it can take a little bit of time to pull everything together.11:51But when it's done, you're gonna see here, I can download this as a PDF, and then I can share that directly with my direct team or upper management. And you can do this with a number of different questions. So I said before, you can generate kind of custom reports.11:59And this is how you do it through the Ask AI tool. So coming back out of the tool and back to our inventory, you'll also see at the top, here's some insights. This is really great to help you organize what you're looking at and think about, ok, what do I need to deal with 1st?12:16This is gonna tell you kind of the most important things you need to know about your assets to make sure that you're completely covered and protected, from, you know, security issues and things like that. But what I'm gonna do is go ahead and click in on a switch.12:36Here, we're gonna get detailed information about that switch. We're gonna see the serial number in case you need to open some TAC cases. And we can see here this is connected through the IQ link. You can also see that here. It'll give you coverage information if it's covered warranty information, all sorts of information on there.12:53If I click on hardware, it's gonna show me a detailed listing of all the minor line items that are connected to that switch. So here we're seeing there's a power supply and the serial number that's associated to that. So for all sorts of different devices, you're gonna see every minor piece that's attached to that device.13:14You're then gonna see the end of life milestones to help you plan for when do I need to replace this device? When do I need to start talking to my Cisco account executive about the future of this architecture or this device type? So you can see, you know, end of life was announced on this switch in 2020.13:34And right now we're at the end of software maintenance releases, and the last date of support is gonna be 31 October 2027. Well, that's coming up next year, so I absolutely need to be including this in conversations about.13:54How do we replace this? What's it gonna cost? What's the right type of device to replace this? So I can help manage the device's life cycle, and I can do the same with software. So I can see right now this is running fifteen.two, and this reached last date of support on October thir.14:0931st of 2021I need to update the software on this device. I am currently vulnerable to attacks because I am running a very old version of software. So that helps me know what my next next task is for this device.14:29And you may have noticed I skipped product alerts. I'm gonna go ahead and click in on that. Okay, well this device doesn't have any security advisories and it doesn't have any field notices that are currently affecting it. The only notice is the end of life, which we kind of already talked about. So I'm gonna go back.14:47And just pick a different device and see if I can't find one.15:07That's got some product alerts. Nope. Okay. Well, what you would see here is you would see any P certs or CVEs that are affecting this particular device. And we're doing something that nobody else can do here. What we're doing is we're actually looking.15:12Looking at through telemetry, the configuration that you have on your device. And we are running that through AI to see am I affected by the CVE? Am I affected by this P cert?15:32Essentially what we're going to do is eliminate false positives. So a lot of my customers, they get notifications about a CVE and they have to go in, they have to read the CVE, look at the configuration guides and then go check each device by device and see.15:45Is this device configured in such a way that it'll be affected? And they spend a lot of time doing that. That is not a way that we can manage our devices at scale moving forward. And I'm gonna talk a bit more about that. There's a way to look at security advisories in an environmental level versus a device level.16:03And I'll show you more about what a security advisory or a field notice would look like for it to have shown up here and been affecting this device. But before I do that, we've also got some end of life reports that we can run.16:23I showed you how to build a custom one, but in case you just wanna see, hey, I want to know everything end of life related for my device. You can pull it up here and here's a listing with all of your key milestone dates, and you can do that for both hardware.16:39And the software that you are running on your device. And finally, I'm gonna show you service contracts. Here you're gonna see all of your contracts, so if you're going through a Cisco support renewal, you'll be able to pull this up and easily understand.16:54And what devices you have under contract and what needs to be renewed.17:14You can go into a contract number and it will list out all of the assets. This is really, really important to make sure that you've got an eye on your coverage. 40 % of new security attacks that we're seeing in the marketplace today are targeting end of support life devices.17:18Through using AI tools, attackers are able to create more sophisticated types of attacks than they were able to do previously, and they're able to do it with a lot less man hours put into it. Meaning they can tell the AI agent, go ahead and try to crack this old device.17:40And when they're doing that, they're creating vulnerabilities that we didn't prepare for. And the only way to protect yourself is to make sure that you're keeping track of your last date of support, replacing devices when they reach last date of support, and then making sure that those devices are under support contracts so you get the right security update.17:55Dates and security fixes immediately to make sure that you're protected against what we Cisco see out there in the environment. And I'll jump into a little bit more of that in.18:16Now, as I move into our assessments, here we are gonna run a number of assessments against your devices, utilizing telemetry and looking at your configurations. And here you're gonna see, hey, here's a bunch of really cool dashboards that are gonna show me.18:28Some detailed information.18:48On my devices, and these come from these assessments that we're running over here on the left. And what we're doing is pulling in your telemetry and then using AI agents on the Cisco side to look at TAC databases, CVE databases, P cert databases, to give you insights.18:50What does that AI agency see when it comes through our large data pool and how does that apply to you? With the purpose being to give you a better capability to scale in terms of managing your devices?19:09So we've got security advisories, security hardening, configuration, quantum infrastructure field notices, software releases, certificate expiration, all sorts of things. It's important to note that your support level matters here.19:25Basic support is only gonna give you security advisories and field notices from an assessment standpoint. For all the rest, it's gonna require a standard support level or higher signature support. I'm gonna start with security advisories.19:41And this is something that you get with basic support. And I said before, hey, I'm gonna show you how to look at your security advisories on an environmental level, not on a device by device level. And so this is how you can do it.19:58You can come in here, you'll see the list of advisories that are affecting something in your environment, and you can sort it by severity. I recommend doing that so you can see your most critical advisories and deal with those 1st. But we're gonna tell you what assets are affected.20:13And as I said, we're looking at configuration information so we can tell that you are affected and we're eliminating false positives and the requirement to spend time investigating those. You'll also see any devices that are potentially affected.20:30I'm gonna go ahead and click in on a severe, a severe advisory, and here I'm gonna get, ok, here's the information about this advisory. So you can read about the advisory, get all the information you need, and here's a link to go read that on these.20:45Cisco website. But what's more important is, here are my list of devices that are affected by this advisory. And I'm gonna go ahead and click in on one of these devices, and here we're gonna give you the evidence as to why your device was affected.21:05This is where we're gonna prove out that we're eliminating those false positives. Matched unconfigured features, web UI enabled and HTTP HTTPS sessions deactivated. So this here is the reason that this device is affected alongside the fact that it is matching.21:24The software that we see being affected by this security advisory. So now you have all the information you need to go ahead and start remediating this. So I'm gonna pause here because Cisco IQ is part of a larger Cisco strategy.21:44We are collapsing the many many portals that we have into a single pane of glass. And that single pane of glass is gonna be Cisco Cloud control. If you went to Cisco live, you may have heard about this or seen this. It is not yet.22:04Get gone general availability, but Cisco Cloud control is going to be your overall pane of glass to manage your Cisco environment. And Cisco IQ is going to be a direct piece of cloud control. It is the eyes to cloud control. It is the ears to cloud control, providing it with telemetry into.22:23Information, but within cloud control, you'll be able to directly manage Cisco IQ. You'll also be able to directly manage your devices and go ahead and actually remediate what you're seeing here in Cisco IQ and you're gonna be able to do that at scale. And that's incredibly important.22:43Because of what we're seeing in the market today with all the new AI agents that are being released, vulnerabilities are going to increase and we see them potentially increasing exponentially. So Cisco is a part of a couple of different programs. We're part of open ai's day break program and anthrough.23:02Topics, project glassming.23:22This gives Cisco, and that's somewhat unique, there's only a few vendors that are a part of this program, but we get access to AI agents and tool sets that are not yet released publicly, and we use those to actually look for vulnerabilities in our own equipment so that we can get CVEs and P certs out to.23:24To you, our customers.23:44Before the attackers are able to actually identify and attack those vulnerabilities. But because of that, you're gonna see a lot more of these coming. So you need tools like Ahu to see how you're gonna be affected and you're gonna need tools like cloud control to actually go in and remediate those at scale.23:46The old model of, hey, I'm gonna have a patch window and I'm gonna do that, you know, once a month, every couple of months. That's gonna have to change in the coming years. We're gonna see new attack vectors, new CVEs come in that are highly critical.24:06That you need to protect yourself against almost instantaneously same day. And we are releasing some tools as part of that greater strategy to help you do that. So for instance, on some of our newer equipment, you're gonna see something called live protect.24:23Live protect actually creates a shield. It makes changes at the kernel level to protect you from critical advisories same day before you do a maintenance window. You will eventually have to update it and do the maintenance window, but it's gonna protect you same day so that your.24:38Not doing maintenance windows continuously and constantly. Please make sure to talk to, you know, your Cisco SE.24:58About live protect, about cloud control, once again, it hasn't gone GA yet, but we'll be seeing it soon. That's a little bit about the future, and I wanted to go into it because I'm always asked when I get here, hey, you showed me why I'm affected, but how can I go ahead and fix that? And the answer is you will be able to.25:06So I'm gonna jump ahead and kind of just show field notices really quickly. But this works the same way as security advisories, you'll see what's affected, what's potentially affected. You click in on it and you'll get all the information. Here's the affected devices, and if I click on one, we're gonna tell you what.25:28Why that device was affected.25:48So that you know what's going on with your devices and you can take the steps you need to remediate those devices. Now I'm gonna jump into some of the higher level assessments that we have, the ones that come with standard and signature support. So security hardening and configuration.25:50What we're doing here is we're looking at Cisco best practice. So we release a ton of different best practice guides. You can go online, you can read them today that say, if you follow these rules, we believe you will be in the best possible situation for your assets. Security hardening is directly related to.26:09To are my assets as protected as they possibly can be?26:29Configuration is, are my assets configured to maximize uptime and to be optimized to run, as well as they possibly can. And we go and rerun assessments against your devices to see if they follow all of those rules to put them in best practice.26:34So I've come into security hardening, and here I can see these are the best practice rules. These are the assets that are evaluated, and once again, this will run on assets that have standard or signature. It will not run on assets that have basic, but you do not have to standardize on a support structure. You can pick it asset.26:53By asset. Here you're gonna see the devices that did not pass the rule, and here you're gonna see the devices that did pass. So I'm gonna go ahead and click on one where we have assets that did not pass, and this happens to be road detection all channels.27:13Here I'm gonna see the actual rule. Validate the monitor channels is set to all on each band and I can go in and actually read the best practice guide. Here are the list of devices that did not pass. I'm gonna go ahead and click on one.27:30And here are the findings as to why that device did not pass. And we're gonna go ahead and show you command line of what is incorrect on this device. If you have signature support.27:46We will show you what you need to run in order to actually remediate this best practice issue. And if there's command line requirements, we will show you the command lines as well. So one additional feature that comes with signature is we will show you how to remediate.28:03Best practice, security hardening configuration and all sorts of things. I'm gonna go ahead and move into configuration where we are looking at maximum uptime. Another feature you're gonna get with signature versus basic and standard is the deep insights.28:22And what these deep insights do is they tell you where should I look 1st?28:42So you're in Cisco IQ, you've got all these, you know, assessments that you're running and you're thinking, I don't have a lot of time to deal with this today. What do I really need to deal with? What is most important to my environment? You can look at the deep insights and it will tell you what you should look at 1st and what's most critical.28:47But once again, we're gonna see a list of devices that don't pass the best practice for configuration.29:08Okay, here's let's see. These passed, let's see, find some that didn't pass. All right, got one that didn't pass my NO WMI interface detected. I click in on that, I can see the information about the rule, and here's the one that didn't pass.29:15Here's why it didn't pass, here's the command line information that didn't pass, and here's some suggested actions if I've got signature to go ahead and remediate that. Now I'm not going to go too in depth in some of these other assessments because they all work.29:31In very much the same way. Passed, did not pass, but we've got a ton of assessments here. So if you're concerned, if your devices are quantum safe, we can run best practice assessments to see that. And once again it works the same way. We've got rules. If the device passes the rule, great. If it doesn't.29:48You can go in, look at it and remediate it. Okay.30:08We can also show you when your certificates are going to be expiring, so you can make sure to manage your certificates. You never have those go out. And then we've got software release conformance, which is gonna go in and see if your software devices are at the correct release.30:12And help you maintain and manage that as well. So we've got a lot of different things that we can bring to bear to help you better understand your assets, better protect yourself from attacks, maximize your uptime.30:31We're gonna be releasing more assessments over time through Cisco IQ. Some of these are actually fairly new, like quantum safe, software release conformance. We just released those and there will be more. We really want to deliver the value of the information that we have at Cisco.30:46To you through the use of AI agents and Cisco IQ. A lot of these assessments are the same types of things that our professional services organization has been delivering at cost to customers through things like health checks. And now you have them at the tip of your fingers.31:05I'm gonna move over to our support platform where you can manage all your Cisco TAC cases. And I'm gonna go ahead and jump off the overview and jump into our cases. And here you're gonna see a listing of all the TAC cases that are open, and this is all cases.31:25If you open it via email over the phone, all your cases are gonna show up in this list. But you can also open cases directly from Cisco IQ. And this delivers a unique benefit to Cisco IQ that we call rapid problem resolution.31:43We're gonna pull the logs and the configuration if you open a case from IQ. Those logs and configuration are gonna be sent to Cisco TAC, the AI agent's gonna look at those, it's gonna look at the TAC database and it's gonna come back and say, here's everything you need to know that Cisco already knows about this case.31:59And for a lot of cases that's, hey, we've already solved this several times, and here's the solution. And it's gonna give that report to the Cisco tech engineer. So for a lot of easier cases, they're gonna have the solution immediately upon you opening the case. We are seeing a mean time to resolution reduction of 44.32:19For customers that utilize rapid problem resolution. So another excellent feature of Cisco IQ. But I'm gonna once again jump in, look at my cases. All right, here's all my great case information. You can see who the engineer is. I can see my own contact info.32:39Information, I can go in and add a note. This is the same thing as making a phone call or sending an email to TAC. It's a direct connection to TAC. I can upload any files. My logs and configurations are automatically pulled if I open the case here, but say I called it in or sent an email, I can add that here.33:00If a bug is found, I can see all the bug information here and I can see any rmas that get generated on that case here or I can go here and view all the rmas that I've got at Cisco. But what I really want to show is going into ask AI, the LLM again.33:18And I'm gonna browse the prompts and go to cases. And here you can do a ton of different things. For instance, you can escalate a case, you can request a new engineer requeue, connect me, have the engineer reach out to me, right? You can do anything you need to do with a Cisco TAC case directly from.33:38Cisco IQ. And so that's an overview of all of our major platforms. There is one other cool thing I wanted to show here in the assessments under askai.33:59Which is, say you want to know what should I prioritize? What do I need to care about? You can just come in and ask, what is the most critical, I'm not typing well, issue affecting my.34:17Environment and it'll take a minute to think, but it'll actually come back and tell you what you need to look at 1st. So say you're trying to work through some time management issues, you can come in.34:34And actually ask a bunch of questions and it's gonna give you answers and you can ask further questions on this to really dive into, ok, it says rogue detection all channels, that's my most critical issue, so I better dive in and figure more about that. So if you're trying to help yourself out from a time management standpoint, this LLM is an.34:53Excellent tool. The final thing I wanted to talk about before this demo is finished is our resilient infrastructure playbook. So I've talked a lot about AI attacks and making sure you're protected against vulnerabilities.35:13There's some low hanging fruit that you can do to protect yourself such as making sure you're replacing end of life devices, making sure you have support coverage, but it can get increasingly complex once you've kind of covered some of those basics. How do I protect myself in a new AI world with AI attacks? And the result.35:30Infrastructure playbook is gonna help walk you through that. So here we're gonna map the attack surface, this is the low hanging fruit I was talking about.35:50Then it's gonna help you remediate your critical and high exposures, help you dive into that. It's gonna help you do, you know, iOS updates, make sure you're on the correct software level, all sorts of great things there. And then finally, you're gonna go into the final step, which is modernizing legacy systems, helping you figure out what.35:59Needs to be replaced and you can even go as far as, you know, working with Cisco on Talos.36:19Incident response, setting up response plans, making sure that you're covered if an intrusion does in fact happen. And we are gonna have more playbooks that release with Cisco IQ over time as well. So with that.36:25I'm going to exit out of our demo and I want to thank you everybody for your time today for taking a look at Cisco IQ. Hopefully you were able to go to the website and log in and create your account. If you've got additional questions on how to upgrade.36:42Paid your support service to standard or signature.37:02Please contact your account manager and you can ask any questions around Cisco IQ by using your phone on the QR code and going to our Cisco communities group, where we will be answering questions and making sure you have the information that you need. And with that, I thank you so much for your time.37:05I hope you get a chance to check out Cisco IQ and if you're one of my customers, I'll be happy to jump in and help you dive in and get all the value out of it. Thanks again.37:24