Cisco IQ in Action: Applications, Assessments, and Support

I'll right. Well, good morning, good afternoon, good evening, everyone. Thanks for joining us today for our 4th installment of the Cisco IQQ.00:01The fundamentals, and this one is the Cisco IQ and actions light title change there, but.00:20My name is Mike Jennings. I have the privilege of being a customer success specialist leader here at Cisco. I'd like to also extend a warm welcome to our panelists today. So we have Sal and Jackie Sachin and John. They're gonna be helping with your Q and A as we go through today's session.00:25Hopefully you saw it in the lobby while you're waiting for the session to begin the Slido, we are gonna be using Slido today for both Q and A and there's also gonna be a short poll in there. We'd like to just get a better understanding of where you are in your Cisco IQ journey, so if you wouldn't mind filling both filling that out plus using that for.00:43For Q and A.01:01And then some other housekeeping items, 1st and foremost, all microphones have been muted for your comfort and the comfort of others. If you've not opened up the Slido panel yet, you'll find that at the bottom of your screen. You'll also find that the chat has been mostly disabled. So if you have a technical support issue you'd like to reach out to a panelist, you can do that via chat and they'll.01:02Try the best to help you with that. You also find closed captioning options at the bottom left of your screen. The raise hand feature has been disabled for today's session. The reactions are still active, so feel free to use those. And then today's session is being recorded. You will get a copy of today's recording as well as the presentation materials will get posted.01:22I'll get more information about that toward the end of the session today. And then once the session ends, you also get presented with a brief survey. Now, I will say for this session in particular, this is the very 1st time that this one has been presented, so I would really love that feedback, pros and cons. There's also some free text there and and anything about the series so far, anything that you'd like to recommend for improvements, we'd appreciate it.01:41That feedback.02:01All right, so I mentioned this is section number four of our September Cisco IQ fundamentals series. Today we're gonna be getting specifically into the different modules. So assets, assessments and support. I know there's been some title changes there, so you're in the right place.02:05So this is the 4th session we'll talk toward the end of the call about the October sessions. But for today, what we're gonna look at, we're gonna do a quick overview just like we've done in the past few sessions. I don't want to assume that just because you're here means that you've been the previous sessions so we'll do a quick baseline of Cisco IQ, and then we're gonna do something I hope that's a.02:22Little bit more fun, a little bit more casual, and something that I call the IT manager's inbox.02:42So we're gonna look at some real customer or some real emails from internal stakeholders, view the IT manager and we'll talk about how Cisco IQ can help you manage some of those requests, right? And then of course we'll, we'll talk about.02:46Resources like we always do. All right? So let's start here. Now, if this is your 1st time hearing this, great. If this is your 4th time hearing it, please bear with me, but I love the slide because it really shows I think the.03:02The chaos that you have to deal with as an IT manager, right? It's more about managing just your estate and it's all about you also need to manage all these information sources on how to manage your devices, so security advisories, device hardening guides, all this great stuff that without a centralized platform like Cisco IQ, that's gonna be on you to.03:17Take all that information to correlate, to collate, and make sense of it. And that's where Cisco IT really helps, right? You feed it your data, you tell it about your devices and your estate. We bring 40 years of Cisco experience and we bring all these disparate information sources into this one place for you to help surface risk, to help.03:35Prioritize your day. And what that really enables is for you to change your footing from the reactive firefighter that we all know, right? To more of a proactive and resilient stance, right? So what does that really mean? So when we talk about Cisco IT, we're talking about complete landscape clarity, right? You've.03:52You've heard the outage that you can't protect what you can't see, right? So Cisco IQ 1st and foremost is gonna help you remove those blind spots.04:12They're gonna help you understand where your devices are, right? And, and, and general inventory, of course, of course. But then we can use AI to start moving into the stance of proactive resilience, and what that means if you think about any time you've had a network outage, right, there's a cause. But what if there was, you know, what if Cisco IQ could have helped you find that cause before.04:18Became a problem, be it security vulnerabilities, configuration issues, right? We're gonna surface that risk for you and with you to help you be more proactive.04:38And taking care of those issues before they become issues, right? And then when we talk rapid resolution, this is actually a really interesting growth area in Cisco IT specifically. So anybody that's worked attack case before and you know, whatever, whatever level, it's generally the same process, right?04:47You talk to an engineer, the engineer asked for some logging, maybe the engineer asked for some more logging, right? And then we can move into troubleshooting. But what if I told you that Cisco IQ, now you can actually open the case through Cisco IQ saving you time. The original, the original or initial log set that the the attack engineer needs. Cisco IQ can go grab that for you, right?05:04Saving you more time. And if the if the package engineer needs more information and they need more logging, right, you can actually provide them direct remote access so they can go grab that and make you not be the bottleneck, right? Saving you more time. So the idea is we're gonna compress the timeline from issue recognition to issue resolution.05:24Right significantly. Okay, so that's what we talked about with rapid resolution. Now, again, before we go forward, I just want to point out a few things. And the 1st and foremost, Cisco IQ is yours to use free of charge, right? No additional charge for this because the features and functionality are actually unlocked by the support that you already have.05:43Right, so this is our simplified support tier basic standard and signature, and you probably already have a mix of these across your devices, but something else I want to_even if you don't have support on your devices, Cisco still offers you some of the features of Cisco IQ for to use for free, right? So things that are.06:02Very important to the health and security of your network. So things like security advisories, asset management, field notices, last day of support, they're so critical to your infrastructure, they're just included, ok? But what we're gonna get into today are things assessments specifically.06:21They're gonna be tied to different support levels, and we'll call that out as we go. But I just want to make sure that we're all kind of level set on how the, the features and functionalities are unlocked in Cisco IQ. Okay, alright.06:37So enough of that, let's get into it. So what we have, what we're gonna see is actually a set of five emails, right? Fake emails that we've gotten from various people throughout our organization. And these are things that everybody's gonna identify with, I'm sure, things that are very manual tasks that you would have had to done that we can go into Cisco IQ and and hopefully.06:54Get a lot, get the information a lot faster, right? More meaningful information that we can take action on a lot faster, ok? So here we go. So 1st emails coming from Jordan. So Jordan's our CISO and Jordan's talking about a P cert, right? I think most of us, probably all of us are on P cert distributions. We actually just had them last week.07:14So Jordan's asking specifically about this one, the CVE, ok? So assume you receive the same, what does our exposure look like? And what's the risk? Okay, very fair. So let's pop over into Cisco IQ and see what we can do with security advisories.07:34So specifically in Cisco IQ, we're gonna get some information. I just actually before I get into that, I just want to point out that this is our demo lab. So there's going to be some features and functionalities in here that an administrator.07:53You don't need to be an administrator to see necessarily what we're gonna do today, but if you are an administrator looking at your environment, you'll see that there's some additional options in here that may not be exposed to, to users. So NO problem there, but.08:11The the goal of today is to make sure that what we're looking at is specifically visible to everybody, ok? So where we're gonna go 1st, and this is our home screen, and we talked, I think quite a bit about how we navigate around Cisco IQ, so I'm gonna move a little bit faster.08:26As we go through here, but the 1st thing we're gonna look at is actually an assessment. So I mentioned that some of these assessments are open to everybody and the one we're looking at specifically is security advisories, and this is one that is open to everybody. Okay, now going back to Jordan's email, right? Jordan was asking.08:41About a particular CVE, so let's just go ahead and search that up here. All right, so this particular CBE that he's asking about, this one has to do with SNMP, so let's go ahead and take a quick peek at this one.09:00Okay, so right off the top, we get some general information in, in plain English, you know, what is the CVE all about? We get a severity rating. We also get the CVSS score, so if you're not familiar with that, it's basically a scale of zero, which is fairly benign to ten, which is kind of an extreme risk, so this one's kind of on the higher end.09:18When it was published, right, when it was updated, and then we have devices that are affected. Okay, very clearly we're getting some telemetry that that reflects a, a particular test case that is is saying that we're matching that CB and we need to take action, ok? Now before we move on, I've mentioned this number of times, but just, just while we're here.09:36Anytime you see a table.09:56In Cisco IQ I just want to add a quick reminder here. We can always customize the view of the table. We always have this gear over on the side. So if you want to add additional columns of information, you absolutely can. If you want to change the spacing between rows, absolutely can. If you want to move columns around, right? You absolutely can do that as well. Okay, just as kind of a side note for your comfort.09:58And how you'd like to do that. Also the filters, we have a very rich filter set, so if you want to look for a particular device, if you want to look for devices from a particular data source, we talked a lot about data sources in the last two sessions, right? You can absolutely do that there. You can save filters, so on and so forth.10:18But what I'd like to do from here, I'm actually gonna take a step back, and we'll go back to the main security advisories page, and what I really want to highlight is our AI driven insights, ok? So we'll give it a second to load here.10:37They'll see the 1st view in our AI driven insights. It's actually pretty general. So what we're looking at here are insights based on all of the CVs in the system, ok? Now Turn wasn't asking about all the CVs. He's asking specifically about the one.10:54So let's actually go and search the one up again, ok? And you'll see our AI insights now has contextualized down to just what we were searching for, ok? Now when we get into the insights, we're always gonna have a couple of things in here. So any of our insights are gonna have a view option over on the right.11:09So when you click on a view, you'll get a little flyout that talks a lot about that particular insight, right? But what I'm actually gonna do is I'm gonna come down and do a full analysis. Now it's gonna take all of those insights and it's gonna compile all of them into one larger analysis. And when you get into.11:29See these analyses screens, a couple of really cool interesting things you can do.11:50The 1st is you can actually customize it and you can customize it in a lot of different ways. So we can add to it. You can use just natural language to say I would like to add a chart that does this. You can refocus it, which we'll actually look at in a future example, right? And you can change text.11:54Throughout. So what I'm gonna actually do here since since Jordan's our CISO I'm actually gonna create for him a, we'll just say an executive briefing at the top here. So you're prompting, you know, your mileage may vary, this is the prompt I'm gonna use. Please create a bulleted executive summary on exposure risk and remove.12:11Creation, right? That's what he's asking about. So let's try.12:31Okay, we'll give the AI in just a minute to think about that. And while that's processing here, just a note about what you see at the bottom while we're in customization mode, we can actually delete things that you don't want to see down here. We can move them around. And as you add things, you'll see they start to populate at the bottom there we go.12:35So executive summary, let's actually move that to the top, ok? So we like that. We'll keep it if you want to have the AI try to recreate it, you certainly can. And do keep in mind this is generative AI, so we don't want to trust it at face value, right? We definitely want to trust but verify, right?12:52But if you ever wanted to redo regenerate, you certainly can. But we'll say this one's good, we're gonna keep it. Okay, now how do we get this to Jordan? Well, two things we're gonna do. 1st of all, why don't we just go ahead and download it, right? We'll just make it a an instant PDF here.13:12Alright, there we go, missed it the 1st time. Okay, so now you have a PDF of what we're just looking at. Pretty cool. All right, so we could certainly send that to Jordan. All right, we can also save it as a report. I'll just go ahead and do that real quick.13:30So we'll save, let's call this test. And you'll see when we go back to the main screen or back to the home screen, we'll have a reports option in there. The one other thing Jordan asked us for that I didn't grab already is an export.13:47Of the affected devices. He was asking specifically what the devices were. So we go back in, we can actually hit export here and grab all the devices. Is that useful information? Maybe, maybe not. But we can download that CSV Excel, we'll just do a CSV. We'll take all of the the default details and we'll just go ahead and export, right?14:04Okay, now I'm not gonna pull that up. It's just gonna grab a CSV file of all the data that we have there. Just one more thing. But regarding the report, let's go take a quick peek at that. I'm gonna go back to the main home screen. And again, you can just use the top icon, right? Top left, that'll always take you back from the home.14:23I'm gonna pop into reports and the report we just created. Okay, now just something I wanted to show in this, we have snapshots of this report, so if you create a report that, you know, is useful over time, right? We can take snapshots however often you like, right? And we can kind of go back and forth.14:40Different versions of the snapshot just so you can see trending over time. We can regenerate the report to create a new snapshot, right? We can delete old snapshots, we can delete the whole report, right? Pretty straightforward, but, but I think that's probably good for Jordan's request. So let's go back and take a peek.15:01At that again, ok? So what does our exposure look like? The device is at risk? So, you know, did we solve the problem? No, we didn't, but we've really narrowed down the focus of the problem, right? We we've narrowed down to the right information so we can start to take action on the information. Okay, so what do we send to Jordan well? You know, we could send them the list of devices affected.15:20We can send him the actual.15:40The security advisory that was linked back through Cisco IQ and then we can send them the the report. And again, this is gonna start the conversation. How do we remediate, right? And in the executive summary we kind of have some ideas on how to get started there, ok? Now, again, I'm just gonna say like just because I'm showing a way to do something doesn't mean it's the right way to handle one of these.15:41Request doesn't mean it's the only way to handle one of these requests. You're gonna need to get into the system and find what works for you, of course. This is just an example.16:01But in the in the presentation materials that you'll get a copy, I've also included the ad prompts that I've been using throughout, so just as a reference for you. All right, so let's move on to the next request, and this is an interesting one.16:09So this one comes from Priya. She's our compliance auditor, and she's hearing a lot about PQC regulatory compliance, ok? So does that affect us, and if so, do we have a plan? Very fair question. And then by the way, what is PQC, right? Kind of tongue in cheek, but I think a lot of us have that question. It's one of these kind of ambiguous topics that's that we think is.16:25Not far out in the future. So I added a slide on PQCC. I'm not to say that I'm the expert on PQCC, but this thing everybody has a foundational baseline. So we talk about PQCC, we're not talking about the advent of quantum quantum computing. What we're talking about is this concept called Q Day.16:45And Q day really gets to the idea of the literal day. We don't have a date, but it is a literal day in our literal future where quantum computers are able to break today's encryption protocols, right? So this is something that we have to plan for. And don't think of quantum computing as just faster versions of what we have today.17:03What it is, is really a paradigm shift, right? It it approaches problems in a completely different way. And we're not gonna get into quantum computing, of course, but think about the encryption we have today and the encryption we have, we will have tomorrow. It's all based on math, ok? The math that we have today is so complex that our computers, even our fastest computers today.17:22Will take months, years, decades to solve the encryption that we have today. They're able to do it. We have, we have the the know how, we've had the know how since the nineties on how to do that kind of math.17:43But what's gonna happen is the quantum computers will be able to solve that math so much faster, talking minutes, hours, weeks, right? Rather than potentially decades, ok? So why is it a today problem? So a couple of examples of why it's an issue for us to deal with today. So the 1st is this concept of harvest now decrypt later.17:54So if you think about yourself sitting at home making a connection over the internet to your bank, right? Doing, doing some online banking, I can watch that traffic from your house to your bank. I can't do anything with it because it's encrypted, right? But I can capture it. And, and the idea here is I can capture that encrypted data today.18:14And post Q day I can actually decrypt it and it's still valuable information. It's your banking details, it's your social security number. If you're talking to your dr., maybe it's your medical records, you know, a lot of very private, but very profitable information for me, right? If you're in the hands of a bad actor, right?18:33So we want to prevent that. We want to use encryption standards today that prevent that in the future, ok? There's also this concept of trust now and forge layer. So what we're talking about there is again using the example of your internet banking, there's protocols in place today. So whenever your computer connects to your bank.18:51There's a trust exchange that happens, so you know that you're talking to your bank, your bank knows that they're talking to you. So when we talk about PQC, when we get past Q day, there's this, the idea that we're gonna lose this trust. We'll lose the ability to trust who we're talking to if we don't take action today.19:09So what that means is a person could insert themselves into the middle of that traffic, so when you think you're talking to your bank, you're actually talking to a bad actor who's collecting your details, right? Your information. The other thing that might come as a surprise is if you're in a regulated industry, you're on a deadline. Now I've included at the bottom here and we'll show in Cisco IQ as well that some of the earliest compliance does.19:26Lines are approaching the end of 2030, ok? And there's more information at the bottom there from the from NIST specifically about PQCC and some deadlines approaching. Alright, so what do we do? How do we take actions? So let's jump back to Cisco IQ.19:47We're gonna go into our home and assessments, ok? And two things I want to show you in here. The 1st is more of a dashboard and this is just on the overview page for the assessments. So we have the quantum safe readiness and quantum safe pillars. And this just gives you a snapshot of your overall.20:06PQC strategy or or, you know, where you are in that journey. Now you can see our demo lab here, right? Needs some help, needs some work for sure. But one thing to point out in the top here, I mentioned deadlines, so by default, you're gonna be seeing the US If you are in a different country.20:27Or you have, if you do, if, if you have a, you know, maybe a remote site in a different country that might be beholding to different compliance standards, right? You can absolutely change and this will update based on, you know, what you tell it here, ok? Also at the bottom, we start to see.20:42That we have some not eligible devices. So I mentioned Cisco IQ is yours to use free of charge, but some of the advanced features that we're looking at today are only available for standard and signature, ok? So as you go into any of our assessments on the left, we're looking specifically at quantum readiness because that's the topic at hand.20:59You'll see at the top, we've started to include the level of support that you, your devices need. So any device that doesn't meet that tier, that's fine. It just, it'll be ignored by the assessment, ok? So we'll need to take some action if you want that included in the assessment.21:18Alright, support types or software support types for the assessment, this is different for each of the assessments. And then this one is good to look at as well. So for this particular assessment, we're gonna be relying on telemetry, the richer telemetry that we get only through Cisco IQ Link.21:35We talked all about Cisco IQ link last week and how it was different from a telemetry perspective from things like CSPC and CX agent. So, you know, if you're, if you're looking to deploy a collector, Cisco IQ link is your path forward. If you have CSPC, if you have CX agent.21:51You know, the writing's on the wall, they're not ending support for those immediately, but you know we need to start taking action to move away from those in favor of Cisco IQ Link for this very reason. All these assessments are gonna start to be built around that richer telemetry set that we get through Cisco IQ Link.22:09Okay. So again, you know, kind of walking through what can we send back to Priya? Okay, so we talked about the devices that are covered here. I'm gonna say let's talk to the AI cause, you know, we could look at the bottom and maybe we make sense of some of this, maybe we don't.22:25And that's fine, right? So let's come in and look at the insights just as a starting point, and I'm actually gonna go full analysis mode again, right? Maybe Priya would find this interesting, maybe she wouldn't, but you know something we can send back to her is basically an overview of PQCC and then we can start to surface data.22:43Right, I think that's, you know, where we really need to start all of these conversations. Let's just make sure that we're looking at the right set of consistent data. Now something for this that I want to show, you know, this is gonna be very general. You see this is a huge report, right? Cause we look at, if we look at PQC in a lot of different angles here.22:59But for this one in particular, why do we customize it? And I mentioned we can do a couple of different types of customizations, so instead of adding to it, why don't we come in here and change the focus of it? Cause she was asking specifically about compliance, you know, so maybe we can refocus.23:17You know, priority order across all severity tiers. That sure that makes sense. Right? So we can select that, we'll hit go. Now I'm not gonna wait for it, we're not gonna download it to look at it. But again, just to show that the data that you're trying to get to, the report that you're trying to get to, the narrative you're trying to get to, right? It's all here, it's all.23:34Customizable very much to the need.23:54Okay, but the key is that we have real data s real assets sending real telemetry that we can work with, ok? Now, again, we're not gonna go through the process of of saving the report and the PDF again but ok so if we go back to.23:57Riya's email. So what might our response to her look like? I mentioned, you know, we can, we can give her some good snapshots of where we are today. We can give her some reassurance that we know where we stand, right? That we know that based on the data that we have, we surface the risk.24:15And now we need to have a conversation about what we do about that risk. Well, we just created a kind of an order of priority for her to start having that conversation. So we can at least tell the story that we know the risk and we can start taking action against it, ok? Alright.24:32Next up we have Marcus. So Marcus is our VP of IT, and this will probably, I think land uncomfortably with a lot of people. So can you create for me a few slides for my LDOS network refresh conversation with finance next week? Can I get a name in there? Really need to highlight the risk, also need to forecast network refresh needs over the next three years, ok? Now if you're the.24:50The IT manager receiving this email. You're starting to sweat, right? Cause you're you're seeing your afternoon slip away, you're gonna be creating PowerPoint slides. We gotta do forecasting, so.25:10Okay, deep breath. Let's pop over to Cisco IQ and see what Cisco IQ can do for us. Okay, so this one's gonna be all AI AI driven. Before we really get into that though, I do want to point out a couple of things with the AI that I think we've talked about in previous.25:20Conversations but I just wanted to just_right? So the AI system is always gonna be front and center when you come to the home screen, right? It's just that important, right? It's it's kind of the the key to the the whole platform. So you'll see that on the home screen, you're always gonna see up in the top right, you're always gonna see the AI assistant up here as well.25:39Okay. And when you come into the AI assistant, it's gonna be very familiar, right? If you've worked with any frontier models, you have a very similar harness, right? I mean you can start a new chat, you have maybe some pre stored prompts, you have, you know, historical conversations that you've had, right? Pretty straightforward.25:57You can also change your viewing preference here so we can go up and we can make this adopt view, right? So if you want to add assistant just to stay up wherever you are, great. You can do that. If you're like me have multiple monitors, you'd like to spread out a bit, right? We can even move AI assistant to a completely different screen. That's fine.26:13Or we can just do full screen mode. So what I want to do with this one, this is like I said, one of my very favorite prompts in the library. So we're gonna go into browse prompts and he's asking specifically about devices, you know, past LDOS, so that's gonna be under.26:31Assets, and the one that I love in here is this right here. Generate a PowerPoint summary report for all last day of support assets, ok? So I'm just gonna click on that guy and set it loose.26:51And then while it's thinking about it, it's only gonna take a few seconds for this one. The AI system is always gonna give you its reasoning, right? And you can always kind of watch the task breakdown what it's doing step by step. That's part of our AI transparency. And as a side note, if you come up to the question mark, you can actually see the technical note on AI transparency if you're curious about.27:07Know what models are used, how models are trained.27:27A guarantee that Cisco is not unequivocally is not using your data to train any model, right? Okay. And and very cool, so here we go. We have instant powerpoints. So we'll download that real quick and I'm gonna drag it over just so we can take a quick look.27:30Look at it.27:50You'll bear with me for just a moment alright ok so here we go. Ldos insights. Now, Cisco IQ just saved you.27:55A lot of time, right? Because we're probably 90 % of the way. So if we go through just real quick, you know, we don't need to get too deep into the content here, but the the idea is Cisco IQ just built this for you, right? As, as a story prompt. We're talking about risk, we're talking about security vulnerabilities, we're talking about, you know, high severity.28:12Assets that have already passed LDOS and assets that'll reach out the next twelve months. Now, he specifically asked about 36 months, so we might need to add another slide here, but for the overall request, right, we're we're 90 % of the way there.28:30Right, so let's talk about how we can get all the way there. We can get the rest of that information. So if we come back to AI system and we can browse the prompts again, ok? And let's go back in. We'll look at assets again. We're trying to find something about.28:44Ldos in 36 months. We have this guy here that's, you know, summarized assets the next twelve months. So maybe let's copy that and kind of use it as a baseline, right? So we'll do twelve months and we'll change that to 36. Okay.29:04The same deal. We'll, you know, give it just a minute to come up with the data. And again, this doesn't solve the problem, right? This doesn't go purchase a new hardware, this doesn't make finance say, ok, great. But it gives you the right data to have the conversation, right? And that's what's really the most important part here.29:21Okay, so preparing the answer, again, we're kind of seeing the steps as they go here. We'll give it just another second and it should come back with a nice little summary, ok? Now, this little paragraph might not be enough detail for you, so you can certainly go and analyze the response, go back into the reporting, customize as you like.29:39Okay, so there you go with that. Now, a couple other things to look at here. I'm gonna close the AI assistant out here and we're gonna go back to the home screen, and I'm gonna come into home.29:58And assets, and we could go into the inventory, we've been in the inventory a number of times over this series, but I'm actually looking down to this end of life. And these are specific reports or specific lists of devices that give you the the hardware end of life and the software end of life information. Okay, so two separate reports.30:16We'll come into the hardware end of life. And again, we get the AI generated insights at the top, so you can click into that, you can create some additional reporting, you know, whatever seems to make sense for you there. Something else we can take a look at if we go back to home again.30:36Now we're moving pretty quick through the menus. And if we go back to the home when we come to dashboards, this is the other one I want to look at. In this dashboard, we have a number of tiles that give you a lot of different kinds of information, but all focused around, as you can see at the top here, this is last day of support information.30:55We also had peer benchmarking that we talked about probably actually in the 1st session that we had together where you can see how you stack up against your, your contemporaries and your particular market or industry, but in the LDOS we see information and this this will actually right here this tile is exactly what he's looking for. So.31:13You know, tell me about the devices that are coming up on last day of support within the next 36 months. Now something that I wish we had that I want to highlight for you as well is the ability to grab that image, that graph, and download it because that would be really cool to add to the PowerPoint, right? Maybe it's the last slide.31:28That that doesn't exist yet. So, you know, Cisco IQ being an agile product, right? Rapid deployment cycle, rapid development cycle, we'd love to get your feedback even. So, you know, if you come to one of these screens and say, oh, I wish I could do.31:48Right? I want to point out at the bottom here, we have this feedback and we'd love to hear from you, so we can come in and we can do a feature request, you know, and you could put in something even as simple as I wish I could download the LDOS dashboard graphs, right?32:02Okay. So you get the idea. We'd love to have that feedback from you. A lot of the development that's happening today is because of feedback that we're getting from the field, so. All right. Okay, let's go back.32:18And see what else we have here. So we got the PowerPoint, we got the forecast. So let's talk about what we're gonna send back to Marcus. So what did we do? We looked at the AI assistance, we used a stored prompt in the library to generate the PowerPoint.32:36We looked at LDOS information for the next 36 months. We looked at the LDOS dashboard, the hardware software end of life reports, right? Again, lots of great information. You use that however you think makes sense. Fill out the the last 10 % of your slide deck and and off it goes to Marcus, your afternoon is saved, right?32:51So, alright, onto Sam, let's see, so Sam is our security engineer. Now, Sam asked and it asks a very interesting question. What do you make of this whole mythose thing? And do we need to be concerned?33:10This is a lot like PQCC I think a lot of people have heard about Mythos, but not really sure what to make of the whole thing, right? So I added a slide in here just to kind of level set again and what does this really mean to be Mythos ready? And how you should really read that is how are we gonna be AI ready?33:26Okay, so I think a lot of us had a wake up call earlier in 2026 when anthropic released Mythos. We really started talking methos. Because Mythos was one of the 1st frontier models to be really trained specifically on software analysis and specifically security reasoning. And what that means is it's able to find security vulnerabilities.33:41So in the hands of a good actor, right, which, which we like to believe is the intention.34:01Is it's gonna help us find the the flaws in our software and help close those flaws before the the software gets the market, right? But the other side of that coin is in the hands of the bad actor, now we can find security vulnerabilities and we can now at machine speed chain these exploits together.34:05Right, and and cause a lot of a lot of potential harm, right? And what used to take human programmers months now AI can do in the matter of hours, right? I mean we we've certainly heard stories about the HuggingFace hack, things like that, which is out of the scope of today's conversation, but the point is.34:23Bad actors are now using AI at machine speed and we need to now change our defense posture and do our defense using AI at machine speed likewise. So why is it a today problem? 1st and foremost, because it's not hypothetical any longer, right? It's NO longer just a french friendly chat bot that we're talking to.34:41Right now it's we're actually have models that that are are causing real risk, ok? And the real risk is coming from unpatched systems and specifically last day of support devices that don't get patched, right? Those are gonna be your most vulnerable, most critical.34:59Attack vectors, ok? And patch cycles just aren't fast enough at this point. Now some interesting reading at the bottom here, if you've not heard of five by cyber security, it's actually a cooperation between five different cyber security agencies and they they released a joint comment or joint statement on.35:15The rapidly transforming cyber risk with AI, right? It's not the sound alarmist, right? It's not to be the sky it's falling, but it is a wake up call for all of us. Like we need to think about security differently. All right, so what do we do with that? How does Cisco IQ play into that?35:32So if we pop back over into Cisco IQ, and again, we're on the home screen here. Something that was added recently is this concept, this resilient infrastructure playbook, and this gets to a whole architecture of resilient infrastructure services.35:48Right? And what it is, it's not meant to be a one and done playbook. It's not step one through three and then you're good. It's a cyclical playbook, right? This needs to be a repeated process and and the process overall is pretty straightforward, right? Step number one, we're gonna map the attack surface, right? We're gonna identify devices that are at risk. So we talk at the top here about devices.36:05That's where we're getting telemetry devices that we're not devices that have support and devices that don't, right? That's number one, right? You can't protect what you can't see. So we're surfacing that risk to help you understand that. Okay, Step number two is talking specifically about remediation, critical, high exposure.36:25What do we need to do about it, right? So as you go down through the list here, we're talking about all kinds of different things, security vulnerabilities, configuration issues, software issues, you know, software that needs to be upgraded. I'll come back to that in just a moment, right?36:44And then step number three, we're talking about devices that are just beyond our help at this point. Devices that are past last day of support. So again, kind of like with the last one, we're looking at what is the outlook for last day of serve or last day of support on our particular devices. You could also look at it in terms of software as well.37:00Now, throughout all three of these steps, professional services are available either through your partner or through Cisco, they can come alongside you or any or all of this journey, right? And, and they can provide additional, you know, health checks and guidance on how to get healthy, how to stay healthy, stay defended, right?37:18Well one of the things I want to dig into here just to kind of show kind of a cool feature that's been added recently. So one of the things we're talking about here in, in the RIS playbook, well, I mean, of course, is one of the primary development areas for Cisco IQ. So this will continue to expand into different services.37:38But this one is actually driven off of Cisco IQ link and we can look here and actually upgrade, right? So one of the recommendations is to upgrade iOS XE software, right, to resolve some of these issues. I just want to show that real quick what that actually looks like.37:56If if I say upgrade a switch to you and that makes you start to sweat because you've never done it before, and it's such a complex process, I get that we've been there, right? So if we come into one of these devices that's eligible, right? Again eligibility is based on the device type, the software type, but also the support tier, right? So this is available to.38:13Standard and signature devices, ok? Now you see all these are in progress. I mean, again, this is a demo lab I'm just gonna grab one kind of a random here because I want to show the process. We take all the guesswork out of it, ok? So Cisco IQ is recommending a particular release we want to go to, ok? Great. So we're gonna go through the whole process.38:32With you together. Now I'm not gonna go through the whole process here today, of course, but as you go through, it's gonna give you step by step, right? We're gonna confirm that this is the right software version to target.38:52And you're gonna check the box and move on to the next step, and it's not gonna let you move on to the next step until you confirm that you've done the previous step, ok? Pretty cool, pretty useful. Right, and as you go through all the way down to execute. So when you get to it, you can exec you can have the system execute the upgrade for you or you can do it manually and come back and do some checks with it.39:03Right, but the whole process is scripted to take all the guesswork out, hopefully save you a little bit of time, little bit of heartburn in the process, ok? Now I will say this is not gonna take over the functionality if you're already using something like catalyst center, e.g., in the swim process. I would absolutely encourage you to keep using that. It's just if you if you don't have access to that, this is another.39:23Way to do it and very straightforward, very helpful in that regard. Okay. So as we continue to go through there, we talked about the RS playbook. Something else I want to take a quick look at here is another assessment called security hardening.39:44So if we come into assessments and security hardening, now security hardening guides come out pretty regularly from Cisco, and this is again one of those information sources that you're gonna have to keep track of as an IT manager or you can let Cisco IQ do the correlation work for you, right?40:02One of my very favorite things in here to search for, is type seven passwords, right? If you know, you know, and hopefully nobody on the call here is using a device that's still secured with a type seven password. You can go out to Google and search.40:18Crack type seven password and you'll get popped up with, you know, a hundred different tools that'll do it for you. But let's take a look and see if this is actually still a thing. And of course it is, right? We still have some devices using type seven passwords, so what can we do about that? So let me expand the list here.40:37And before we get into it, again, without every assessment you're gonna see at the top, you know, what the assessment does, you'll see the security the particular software that we're in or we're looking at very specifically was one for iOS XE, right? And we can also even go out just like we could with the CBE, we could go out and look and see the actual.40:54Partnering guide that's being referenced here, right? So you don't have to go Google that separately.41:14But let's grab a device, and this one you'll see is on standard. Okay, so let's grab this device at the top here. And when you come into this particular assessment, it's gonna show you very specifically why this didn't pass, and very specifically the evidence here is, well, line 1807 of the configuration, here's our type seven password.41:19Word shame on us for still using that.41:38Right, but if we take a step back, I'd like to show you just some differentiation here. So if we go into the next one, this one's actually on signature, still get the same evidence, right? Again, this is why we flagged it, this is, you know, this is why it's a problem.41:41But boom, look at this. When did we come down signature devices have access to actual recommendations, so AI driven recommendations or recommended next steps to resolve the problem, right? Now, again, this is all generative AI, so we need to trust but verify, but you can see if you're done.41:58Any any work in the on the command line and pretty straightforward, right? Config T NO username, add a username secret. Makes sense, right? This is a pretty simple example but again it shows kind of the difference between the standard and the signature where the signature is gonna give you that additional.42:16Insight into recommended actions. Okay. So there we go with that. You know, maybe one other thing we could do if we come back and let's actually stay. Oops, sorry to scroll around there.42:33Let's actually stay in the assessment and the security hardening and one other AI feature I want to point out that while you're in assessments specifically, and sometimes other areas within Cisco IQ, you'll actually see another link to go to the ask AI, to the AI assistant.42:50And when you see this guy, it's actually gonna pop up a contextualized conversation. You can still ask whatever you want, of course, but it's gonna be contextualized based on where you are within the Cisco IQ application overall, ok? And you can certainly ask at anything you like from there. We can browse prompts.43:07One that I like to do here just as an example, you know, if you don't know where to get started, you know, or if you just need to start the conversation, a good prompt here, what are Cisco security hardening best practices for network devices, ok? Again, just a very generic example and you'll see where.43:26Again, talking through the different steps and might not give this one the full amount of time. We'll give it maybe another 10 s to see if it comes back quickly here. There we go. Okay, now it's, it's pretty generic, right? It again, it's generative AI, we need to trust but verify.43:43But, but good stuff, good conversation starters here NTP security of course, right? Disable any services, of course, right? We need to turn off things like HTTP. Great. Password management, all kinds of good stuff there. And then references out to the again the hardening guide, right? Just to give you more information about them.44:01Alright, so I think we're probably good with that one. So what does this look like? Well, let's go back and take a peek at our email. Oops, that's not it.44:18Sorry about that. There we go. So what does our response do you Sam look like? Well, you know, we talked about the playbook, maybe we could even create Sam an account, right? Since he's on the network team. Maybe we can create him an account in Cisco IQ, a view only account.44:36So he can go look at the RS playbook. Great. You know, he can look at the security hardening assessments. You know, we can link him out the guides, but again, just some things we looked at here. Okay, we looked through the software upgrade, we looked at the security hardening, and again, a prompt that you could reuse if you like.44:51Right, alright, we're still doing pretty good on time. So we'll go from the 5th one here and I think this one's gonna resonate with a lot of people as well. So Alex sends this email. Alex is our security or network engineer rather.45:09So Alex is asking any idea what this error message means? So seeing this on this particular device, which is an ISR 4331, great, you know, very great little router there. And the error message, great, so he shared there now in full disclosure, of course, this is a fake error message. It's a real device in our lab, but it is a fake error message as we go through.45:24But you know.45:44What would you do if you got this message? I'll tell you the 1st thing that I would do, right, as the IT manager. I'm probably gonna take this error message and drop it in Google, right? And I'm gonna scroll through probably how many pages in Google until I find one that promises to have the answer only to find it's behind a paywall, right? You start to get frustrated anyway. So what if I told you Cisco IQ can do the.45:46Troubleshooting for you.46:06Great, yeah, let's take a look at that. All right. So we'll pop back over to Cisco IQ. Now, last week, last two weeks actually we talked a lot about telemetry, right? And what we keep going back to is Cisco IQ link is gonna be the source of the best telemetry that we can get.46:08So when we talk about troubleshooting, we're actually gonna look at two examples. We're gonna look at that error message in two examples. The one device that's in reference, let's take a quick look at that. I'm gonna come into assets and I'm gonna go to inventory.46:27Right, and just while that loads, when we come into the inventory page, we'll just do a quick search for the device that was reported as having the issue, ok? So, I mean general information about the device, but what I really want to call attention to, we are receiving telemetry for that device.46:45However, where I'll say and that device is coming to us. The source of that information is from one of our cloud connectors, which is catalyst SD WAN manager, ok? That's great. That's great. You know, from a, from a cloud connector perspective, that's fantastic that we're receiving that, that data. We're, we're getting some, some good.47:04Telemetry. We're not receiving complete telemetry, ok? Just based on the nature of that, of that particular connection. And that's ok. So we'll take a look at this one. Then I'm actually gonna jump over and we'll take a look at a similar device that's actually connected to Cisco IQ link and show you the difference in the troubleshooting.47:24That we can do, ok? So let's pop over. I'm actually gonna use a link at the top here. We're gonna pop over into the AI assistant again. And I'm gonna say in full disclosure the, the interaction with the the AI assistant for this particular thing takes a little bit longer. So what I'm actually gonna do.47:42Is pull up a saved conversation. Actually, let me grab this one here, ok? And this is a bit hardered, so what I'm also gonna do, I pulled out all of the text here.48:01Just so we can follow a little bit easier. So I promise as we go through, it's all the same text, it's just a little bit easier to read as we go through it, ok? So what I really want to show is is specifically the troubleshooting methodology that Cisco IQ goes through, right? It's gonna map probably what you would do, right? You're gonna go to the device, you're gonna try to find where that error message has come.48:17From, right? And you follow a particular set of you know particular methodology yourself.48:37So when we asked Cisco IQ, the basic prompt was, we go back here, please assist troubleshooting that particular device in the error message, right? Very basic prompt, very basic prompt. So what Cisco IQ does, 1st of all, right, you know, it's ok, the device is online and inventory. Fantastic, right?48:42To check for historical records and it's gonna look for the problem itself. It's gonna try to understand what does that problem really mean generally speaking.49:01Okay, and then we're gonna go look at the device itself and what it's gonna come back with is it doesn't have the connectivity to this device that it needs to do live troubleshooting on the device, ok? And, you know, again, that's, that's fine, right? It's still gonna give you some idea on how it can still help, right?49:09So what it's gonna talk about in next steps here is more information than it needs, right? So it's gonna tell you about the the particular issue based on that fake error message, right? And it's gonna tell, you know, I can't directly connect to the device and run these showcam commands myself.49:29But if you can grab the show commands here, you know, I can help continue to troubleshoot for you, ok? And then the overall impact, right? Again, I know that's very hard to read, but just in full disclosure here, right?49:46So next steps that it's asking for needed evidence that it's asking for overall impact. And then here I just kind of punted. Like, you know, this is too much and you just go ahead and please open attack case for assistance, right? Absolutely. And it'll include all that information already there. It's also if you permit it, it's also gonna grab.50:00The initial set of logs and attach those to the case, which we'll see in a minute. It's also going to provide remote access for the tech engineer if they need more logs or if they need to do some other show commands. It's, it's read only access if you permit it again. But again, we're talking about compressing that time from issue recognition to issue resolution.50:20Now in full disclosure, there is more to the conversation, just since this is a demo lab, I wasn't able to open a TAC case just on our demo account, which, you know, there's NO surprise. But if that were to happen to you, the other thing that it'll point out here is you can just go directly into the support case manager, open the case, it'll pre populate some of that information for you.50:41You can still call frontline, right? And open a case. You certainly don't have to use Cisco IQ.50:59All right. Cool. Okay, so let's go back to the inventory. So again, we're in home assets and inventory. And this time we're gonna take a look at a device that is actually connected via Cisco IQ link.51:05Now this device doesn't have a host, a host name configured, so I'm gonna search for it just real quick. Whoops. There we go. Using the serial number. Okay, so it's still a4331 router. Great. You know, we're still receiving telemetry.51:23You know, we have the good coverage status and you'll see that it's actually connected through Cisco IQ link, ok? And that's gonna make a big difference for us. So if we go back into the AI system, and again, this is one that I did earlier as well, just in the interest of time.51:39The exact same oops, wrong one. There we go, the exact same setup, you know, please assist troubleshooting and I mentioned by serial number just so it had a reference to that device, right? But still same error message, and now we get this.51:54Okay, so please assess troubleshooting the serial device or serial number. Ok, so what's the 1st thing it does it takes that serial number and finds the device in question, right? It validates the software, right? Detailed inventory relevant assessments, good stuff. Now here it gets interesting. They have, it has the available connector to run.52:10Or it is current and devices reachable, so attempt to do the live read only collection now and the information. So again, this is, this is verbatim. This is it's just that the the output over here was a little bit more difficult to read live here.52:30Now this is where Cisco IQ starts to get a little suspicious, you know, cause it's going in and saying, well, you know, the buffer doesn't retain the or doesn't contain the reported Mac flap, like, well, yeah, cause it's a fake issue, right? I don't have a, it's a real device, but it's it's a fake issue that we're telling it has.52:45Anyway, so as it goes through, we're troubleshooting step by step. You know, Cisco IQ is doing that, that for you basically. And here we get to the end, Cisco IQ is like, ok, you didn't full me, the live evidence confirms the event it's not active now, and then it starts to.53:02Actually, you know, it doesn't assume that you're, you're trying to fool it, so it's actually gonna go do a little bit more assessment. Anyway, long story short, we get to the end here and it confirms that this error message probably didn't come from this device. So it doesn't say like you tried to fold me, go away, it says, you know, it gives you some next logical steps, if info.53:18In fact, you know, this was a real error message from another real device, of course, right?53:38You know, it's same thing. If you get to the end of this whole troubleshooting effort and you decide that you'd rather have TAC handle it, same thing, you can just sort of, you know, not sort of you can just directly ask Cisco IQ to go ahead and open a TAC case for you based on the error message and based on the entitlement of that particular device.53:42But it also even tried to do its due diligence by looking at software versions, right? It's just a known issue, looking at historical RCA information, right? So we didn't pull it. It was able to get the real information from the real device, and from.53:59Okay. All right, last thing in the previous step there looking at the the San Jose device, we did open a tack case, right? Or assume we opened a TAC case.54:14So attack case management. So if we come back to the home, we'll just show this real quick. Those are really not a whole lot to see in support. It's still pretty interesting though. So again, we can go to home and support or we can just click support, right? All, all three major modules are here.54:29And when we go into support, just a few things I want to show in here. So if we look at the top left, we have 1st of all, cases and rmas for the entire organization. So every case, every RMA that's opened, and then below that you have your cases and your rmas if you just want to see a sorted list.54:45Are lightly filtered list rather. So I'm gonna go into cases and I'm gonna grab a fake case.55:05We'll assume this is the one that got opened for our 1st device when we asked Cisco IQ to do it. And, you know, if you ever worked with the TAC case, I mean, you know, it's, it's pretty straightforward, you can go out to the support case manager site, you know, you can interact there, you can interact now over Webex, you can certainly call and talk to your engineer.55:13But now Cisco IQ gives you sort of a centralized platform to interact with your case, right? So we'll give this just a second to filter, I'm not sure why it's not loading for us. But it's just a few things there goes. So we found it, let's pop in here real quick.55:32So great information that we have here, right? So the 1st, the summary is gonna give us some basic information about the device in question. We'll see information about the tech engineer escalation paths, great, great stuff to have at your fingertips. Historical notes throughout the entire case history.55:50And then this is the really cool one. This is the one that's gonna save you real time. So this is the files, right? So of course you can still upload files from here, right? Or to here if you need to add other, other files to the case, but this 1st one, this very 1st one here automatically generated by Cisco IQ. I mean, that's huge.56:07So we don't have to wait to talk to the engineer the 1st time and have the engineer tell us what files to go get, right? We've just saved a big block of time. Also, and again, if you permit it, you can also turn this off. But if you permit it, you've opened up access for that engineer to have remote connectivity to that device so they can read only so they can go and do show commands and such and do a.56:25Troubleshooting. So again, we're compressing that timeline from issue recognition to issue resolution. Okay, so your note back, just to bring this this full circle, keep coming to the wrong one here, sorry about that. Our note back to Alex, right? So what do we say?56:46We say, oh, by the way, we saved the day for you. Great. So some things seriously, some things that we looked at, we looked at the inventory just to take a look at the device, look take a look at the data source. We asked the AI assistant for some guided troubleshooting, right? The AI prompt here was pretty generic. So having this error on this device, something like that is perfect.57:05Quickly fine as a starting point.57:24So what do you read this thing back to Alex? Well, you know, we found that that, you know, issue was caused by X Y and Z By the way we opened a TAC case for you, here's the TAC case number, right. And we saved everybody really a lot of time. So NO more googling. Alright, with that, I know we're getting very tight on time, so let's bring it all.57:26Home here.57:46So some resources. 1st and foremost, so we're coming to the end of our September Cisco IQ fundamental series. The series is relaunching in October, starting on 6 October, so certainly grab a snap of the QR code here. All the content will be updated for new released features, but generally it's gonna say.57:47Follow the same flow, so we'll do the features and capabilities, we'll talk about connectors and contracts, then we'll do another deep dive into Cisco IQ link. And then like today's session sites into action.58:07All right, other resources that we shared in the past, probably the most interesting one here at the top left is the landing page of resources, so if that's the only one you use, that's probably the best one on the screen. Alright, and then also after the call today, so you're gonna get a survey 1st and then after the survey you'll get redirected to or ask me anything.58:21Page. The page will be live through 30 September to ask questions of our experts, so certainly feel free free to do that. The page will still be there archived with all of our recordings as well as all the presentation materials. Today's recording and presentation will be posted there within the next 24 to 48 h.58:41So you give us a little bit of time with that. And then while you're out at the Cisco communities page, I would highly suggest you take a look at our other Cisco expert insight series and global webinars. So if you go to the top webinars and events down to view all webinars and events, and I like to put it into calendar mode.58:58But you'll find that all of our architectures are covered. We have many global time zone offerings. Content is refreshed pretty regularly, and that's all free. You just need to register, ok? So with that, we come to the end and I'd like to thank you for spending part of your day with us if you've been with us through the whole series.59:15Certainly appreciate all the time that you've invested in both yourself and in learning about our the Cisco IQ journey. And I mentioned today's session is the 1st run, so I absolutely would appreciate some feedback if you wouldn't mind taking the survey as well as giving us some of the the free text, you know, what would you like to see?59:36Next series, right, it's all, it's all very much tailored to you and and to your wants and needs. So, so with that again, thank you for your time. Enjoy the day and we look forward to seeing you on a future session.59:52