Exploring Cisco XDR - Part 1

So, yeah, so thank you for joining us in this expert and expert insight series. So in the next two days, we're gonna be.00:10Talking about Cisco XDR and we've got some exciting content to share with you guys. So, this series runs over two days, so we've got today, and this out is this is our agenda for this morning. So 1st we're gonna have Pierre who's gonna give us a overview and talk about integration with XDR.00:19This session is gonna last about.00:4050 min and then we're gonna take a 10 min break and then Ruben is gonna take over and dive into investigation and response with XDR. So this is our day today, and then tomorrow, yeah, if you wanna stick move over to 2nd day. So on Thursday hopefully you have all.00:42Also registered for the, for 2nd part. So for day two, we have Torst Insurance who is gonna be talking about detecting detecting threats, which is called XDR. So that session is gonna last about 15 min or similar format to day one.01:02So 15 min of that 1st session, a 10 min break, and then we're gonna finish with responding to threats with Cisco XDR. So very exciting few days. We're gonna be talking about some of the newer additions, new features that's been added to XDR so.01:22Hopefully you guys stick around for both days. The session is being recorded and will be shared with you guys a couple of days after after today. You will have a chance to, well we do have panelists available to answer all your questions, so do make use of the Q and A sections.01:39And maybe at the end of the sessions if we have times our presenters will take some questions, but all questions please put in the, in the Q and A panel. So that being said, thank you once again for your time, for joining us today and I will pass it over to Pierre.01:59To begin the session. Thank you, Harry. Welcome everyone to this webinar. I'm going to to actually begin with the the session today. And my name is. I'm based in Italy.02:17I'm part of the customer success organization here at Cisco, and I have been working with customers on board helping them to onboard Cisco XDR in the last couple of years, two, three years.02:34And I will have the pleasure to guide you through the 1st part of this session today. As you can see, we are going to focus on integration. Actually, the focus of my part is the detection feature.02:50Of XDR, that's why we need to talk about integration because in order to detect something, XDR needs to get data and to get data needs to be integrated with other solutions. That's why we are going to talk about telemetry sources, how to integrate them.03:05With XTR how to get data, and then we will.03:25Go through a 1st XDR incident investigation, and then I will after this are the break I will pass the ball to my colleague Ruben for 2nd part which will be focused on investigate.03:31In particular and how to respond to threats. So let's get started. 1st of all, let's talk about what a malware campaign, e.g., a ransomware campaign looks like today.03:45As you know for sure, ransomware campaign is multi ve multi vector, so typically it can start with the message like e.g. in any email and if the user is actually.04:05Convinced to click on that link. Maybe his or her computer will go to a questionable website. The device might be compromised. And then the machine typically tries to spread laterally to other computers in the network.04:23And most of the times, all these security indications are called by different solutions, sometimes even with different vendors. So we understand the the struggle, the the effort that is needed.04:42On your side on on a sock side, on the security analyst side.05:02To be able to collect all this information and put them together. This is what Cisco XDR helps you with. So this is an overall picture of what the XDR provides. At the bottom, there is the telemetry information here, which is the input data.05:06It can be from Cisco solutions, but also from 3rd party because our XDR, and this is one important characteristic of Cisco XDR wants to be open, open platform not only supporting Cisco but also other solutions.05:27And then at the core of, XDR, which is this section on the top, we have our three main features, the detection capabilities, the threat hunting and investigation and forensics. By the way, I want to give you a spoiler on the day two.05:45Our colleague Thirsten will give you a deep dive on the forensics features so be sure to if you already registered, be sure to attend this because it will be worth your time. And then the response capability, all powered by our AI. AI is used.06:05In two dimensions. There's a machine learning and there's a generative AI. And then we have automation capabilities, orchestration capabilities. So our XDR is actually also a SOAR if you're familiar with this acronym.06:24So this is in a nutshell the the architecture of Cisco XDR. Now let's go into, into details. We asked our customer with the survey, what is the most.06:43The the essential, the essential telemetry information that you need to fit into an XDR solution. This is the result of the survey, as you can see the endpoint is going 1st.07:00Of course, without endpoint information, it's difficult to get real information about a threat attack. But then we have networking information. We have network firewall, and DNS also that are scoring among the 1st.07:16Six items. So the NDR component is really important. And then we have some important information at user level, we have the identity, we have the email, which are also important. So if you ask us.07:33What solution should I connect my XDR with? So idea, ideally all of them, of course, but it's not always possible. If you want to have a guidance, this slide is very useful because it shows you the.07:50That if you want to get information about the exploit.08:10You for sure you'll need to have endpoint events for sure. But if you want also to get information about what happened before and after the exploit, then it's very useful use useful to have identity events.08:14And networking events. In particular the networking events are giving you information about what happened in the initial probe, so the recognitions phase, the scanning, and the lateral movement and possibly the data exfiltration which is the ultimate goal.08:30Of an attacker. So as you can see, this is the the whole picture. If you have all of them, you have a full visibility about the attack. NDR. NDR is important and at Cisco of course we.08:48We we started as a networking company, so we believe in the value of this visibility and with XDR, with the NDR, sorry, you're able to see what happened in the north south direction, so.09:07Your network communicating also with the outside world, but also with East west, which is very important to catch the lateral movement and with the Cisco XDR, this is embedded. This is part of the solution so you will be able to get information of what.09:25Happening in your switches, in your network device, but also in your endpoints here.09:45Because we have, and we are providing an agent called NVM network visibility module, which is part of the XDR features and you will see it in action in a in a moment. So summarizing you can see XDR as a soft.09:52Sort of pipeline, this sort of pipeline here. On the left we have all the telemetry information from different sources. Eventually, XDR will possibly raise an incident.10:12Don't don't think that every single security event should become an incident because XDR Cisco XDR wants to be a low noise platform. So you're supposed to see incidents only when something is really critical is really important.10:30And that should, you should take an action upon it. So we have a lot of blocks in this pipeline which work on understanding the, the events. This is the analytics block and correlate events among each other.10:49So you will see an incident that is a contribution is putting together all the information of an attack. And this is another spoiler in 2nd part of this workshop, Ruben will give you more insight about this pipeline. The.11:08Incident generation.11:29Okay, now let's go into the into details about my my part here, the integrations. So integrations, what are they providing to XDR? We can actually classify integration in three categories. There are integration.11:34That provide.11:54Telemetry information from the infrastructure that you own. Let me give you some examples here. Maybe you are familiar with the Cisco Meraki. This is a networking solution, a Wi Fi solution. Meraki can provide information to XDR. We have other examples.11:56Here, not only from Cisco but also from 3rd parties. As you can see, we support the main EDR solution, we support the vendors that you can see here, but also other ones. This is key, this is very important. Then we have integrations.12:16That provide the threat intelligence verdict with this kind of integrations that you can see here, you can understand if an IP is malicious or clean. We support of course also in this case many 3rd party threat intelligence and we are integrated.12:35By default with our own threat intelligence which is Dallas.12:55A 3rd category a 3rd level of integration, some integrations are providing a target for automation. And again, Ruben will give you examples of this one. Webex, Slack are examples where you can use an integration to send a message.13:00Or to receive message and to trigger something.13:19Or you can open a ticket to a ticketing system like. There are integrations that are actually working on more than one layer. A typical example is a Cisco umbrella.13:22If you are familiar with that, with umbrella, you can get telemetry information so you can understand which domains your infrastructure visited, you can get verdicts and you can use it for automation because with umbrella, you can block.13:40A domain. It's important to understand if you are going to use a 3rd party or pure Cisco integration because if you're using only Cisco, then the essentials.13:56A License of XDR might be enough for you if you're using 3rd party, you need probably to evaluate the advantage less license which is providing 3rd party integration. If you are looking at advantage.14:12The advantage will also provide XDR forensics capabilities. Again, keep an eye on the day two session because Thurstan will show you how these forensics shines and give you a lot of.14:29Deep deep very deep information about the endpoint. How to set up an integration? So according to the kind of integration, there is a different way. The simplest one is the integrations that work simply with an OAuth.14:45Authorization. You just need to be logged in with your browser, e.g. secure endpoint. With a single click you can set it up so the effort level is really, really low. Other integration work.15:03Integrations work with the setting up an API token, and then you copy paste into XDR. This is the case, e.g., for our secure access umbrella. Quite easy, the effort level is still low.15:18Then when you integrate 3rd party solution, you typically have some vendor specific methods. This is the case, the case of Microsoft, e.g.. In this case for Azure, you'll need to set up an Azure application to work on a, on your Azure portal.15:36And then actually this is working on a mix of all out and API tokens. Still not so difficult, a little bit of effort more than the the other cases. And then we have on prem solutions.15:57Which will need a little bit more of effort because this is e.g. the case of our secure firewall because the firewall in most cases is an on prem solution and you need to enable the way up to the cloud because XDR is a cloud solution.16:15To communicate, to send information. So there is a bit more of effort here. That's why I'm going to give you some more information specifically about the 4th cases and the firewall.16:32Where to find the integration information. If you already have an XDR tenant, you simply go to administration integrations and you have the screen here. The simplest integration, you just click on enable.16:48And everything works with your browser because they are, you, you, you are giving just the authorization to work on your behalf. The other information like e.g., Cisco duo, the other integration, sorry, like Cisco duo.17:05You have a get started button. If you click it, you will have an integration guide very, very well done, very, very simple. Just need to follow this information and possibly to fill the API.17:21Tokens all the URLs here. If you don't have an XDR tenant yet, don't worry because there is this wonderful website XDR Connect.17:38But you can get who the whole instructions, so even before getting an XDR subscription, you can have a preview, you can see what is needed to get an integration working. Now let's delve a little bit on secure.17:53I will because many customers are asking us how to set up a proper integration.18:13We have this integration guide on the XDR site as I showed you before. And as you can see this is a bit longer than a typical integration guide because at the beginning it's telling you you will need to set up three environment in the Cisco cloud.18:21The security cloud secure cloud control, which is the activation environment, the security service exchange and the security analytics and logging. So it's a bit of components here. Let me.18:40And talk about these three guys. The cell component is actually another license that is not mandatory, but if you, if you get it, it will give you a big advantage because you will have a.18:57Storage, environment in the cloud where you can store firewall events and you will also get an event viewer login viewer in the cloud.19:15This is useful for you because it will give you an extended data retention. You can send the logs from your ftds and other devices and XDR will benefit from it because it can use it for correlation. So the key point to remember is that if you have.19:32Sal, your XDR will be able to see all the connection events from the firewall. So not only the security events, which you will get even without Sal but all the connection events. This is very important to remember.19:52How to get this cell component. If you are in touch with the Cisco salesperson, you can add to, you can ask to add cell license to, to your security cloud control subscription. It's per device, you can choose the retention and the storage amount.20:11Or even easier, you can request a trial from your security cloud control portal 90 days so you can see how it works. And this is the view that you are going to get in security cloud control portal. You will have a comprehensive.20:33The view of all the events. In my case, these are malware events, but you will see all the connection events here and in the same portal.20:53You will see the information of how many logs you you are sending, what is the retention period that you have, what is the storage amount that you're consuming?21:09And now let's give you the whole picture of all these guys in the cloud that I mentioned before. We have the firewalls here on the left side of this picture. We have XDR on the right side.21:28And you have the other components in the cloud. The SAL is here, is used if you have SAL, XDR analytics will use it for analytics and detections, SCC is the event viewer that I showed you just a minute ago. And there is another.21:44A guide, the security services exchange, which is used by XDR to run investigation if you are querying an IP address an external IP address that was seen by your firewall. XDR will get it from here.22:04And what is the value that firewall brings to XDR? Your firewall will be able to see all the events, not only the security events that you can see here, but if you have the sub component, all the connection events from the firewalls.22:25XDR will be able to enrich your information, but even to take actions because you will be able to block undesired IP addresses on your file. Now I want to.22:43To.23:03Tokyo in deep about another integration, which is not actually in an integration because the secure cloud analytics is a part of the XDR bundle, so when you buy an XDR license, Cisco is setting up an secure cloud analytics for you.23:04This is our NDR.23:24Engine network detection and response. For the moment it's a separate web portal. I will show you cloud analytics as a separate web portal, but the news is that it's finally going to be fully merged with Cisco XDR.23:27And it's able to give you visibility about the three telemetry sources and networking level. 1st one the traffic information from your on premises network.23:44You will, you will get it with netflow or even with the mirrored or spam port and because we are providing the sensors, we have two flavors of a sensor, the on prem sensor and the Cisco telemetry broker.24:04So you with your switches will be able to send information here and these guys will send it to the cloud to the cloud analytics component. In a similar way, you can get.24:22Flow information from your public clouds, the major ones are supported and you can get information from your endpoint because we are providing an agent which is part of our secure client suite.24:38Which tracks all the traffic from your endpoint, not only to the external IPs but also to the lateral to the others component computer of the network. Where to find secure cloud analytics data today? Let me switch to my browser.24:56Process I will show you.25:16So we have this this is our the XDR environment. Just to give you a quick info a quick view of how to pivot to secure cloud analytics, you do it from here.25:18You have, links here where you can switch to your portal. I have two in my case because this is just a, this is a lab environment environment, but typically customers have only one secure cloud analytics links link.25:37Yeah, I renamed one to SCA. I didn't rename this one. So this is what a typical SCA organization name looks like. And let me show you a real example of.25:54Of an X secure cloud analytics portal. The 1st thing I wanted to show you excuse me, is the sensors page. This is an example here in this page. I have an MVM sensor.26:13So my computers are, have an agent which is sending information here. I have an AWS sensor and I have some on premises sensors. Not all of them are in a green state, so you have also indication of the health of the sensor.26:28My NVM is working here. My on prem is not is showing it in red status. And I wanted to show you also another kind of sensor that I have in my other portal. This is this firewall sensor. I have it because I have the cell component.26:48Integrated here. And what are the events that I'm getting? Let me show you. Events are in the event viewer section. Here since I have the component.27:08I am supposed to see events from my firewalls and let me zoom in a little bit. So yes, I can see information from my firewall. Excuse me. How do I understand that it's from firewall because I can see that the sensor type.27:25Is sal. You can see it here and you have all the log network information from the firewall. And here in this other environment, I should be able to see events from my.27:42Agent from my computers, let's populate it because this is in under NVM flow instead. Oh, there is NO data yes, it's coming.27:59The engine flow is not only pure netflow information because there is also information about the process name who which opened a connection. E.g., yes, this connection was opened by Microsoft Edge.28:17And we have the process name, the hash, the parent, so this is a thread probably, and the parent is again a Microsoft Edge. This is very useful to know for a security investigation. So very important.28:37And let me show you other things that you have here. We have the alerts, the security events from secure cloud analytics are here with the MITRE attack classification. If you want to tune.28:54The alerts, you do it from settings, alerts, and you can filter e.g. the alerts that are coming from NVM if you just have this, and you can choose which alerts you want to enable.29:11Or, or disabled and if you were the 1st switch actually, if you turn it on, then this alert will immediately become an incident on XDR. So we typically suggest.29:32Not to enable it because we want XDR to use its own detection and correlation engine, but if there is an alert that e.g. you you are particularly interested with because there is an active malware campaign that you are monitoring, you can.29:47Turn this on and you will get immediate reflection on XDR incident. Right, these are the key points in secure cloud analytics.30:05Right. But as I anticipated you, secure cloud analytics is fully converging into XDR. So all the things that I showed you will become part of natively part of XDR. E.g., the alerts.30:24Will become detection findings or incidents and so on. This is very important. You will have more capabilities to tune an incident. For at the moment secure cloud analytics is only able to whitelist based on the source IP address.30:39But in XDR we are going to get more capabilities. These are previews of the of the screens that you're going to have in XDR. So this is the equivalent to the.30:59Event viewer, this is equivalent to the alert enabled disabled, and finally, this is what customers were really waiting for the tuning capabilities.31:14Here, much more tuning capability allow block based on different kind of events. So staying tuned because the 1st level of merging between XDR.31:31And next year is going to happen on 15 May and the 1st component that is going to be migrated is the NVM network visibility module engine. Now let's talk a little bit a little bit about incident because I want to give you an.31:49The demo of how the telemetry information are becoming incidents and how you can work on on an incident investigation. Incidents are coming through correlation correlation between different sources.32:09Every incident has a priority. This is an important feature of our XDR because it allows you to focus on what is most important and maybe to work later on on the things that are less important. And there is an enrichment process, so if an incident.32:28Involves e.g. an IP address?32:48XDR will give you all the information that it knows about this IP address. This is the arrangement process. There is a correlation as you can will see in the demo, then an incident will come with an incident.32:51Chart with all the things that are involved in the incident, just a quick guidance about the colors. When you see something colored by purple, it means that this is something in your organization.33:08An endpointed device when you can see something red, this means malicious according to the threat intelligence sources that we are integrated with. The priority is.33:25Working in this way. XDR will give you a priority score ranging from one to 1000 in this case it's 736. In this example, it's computed with the multiplication detection risk computed by XDR based on the tactics.33:41On the severity of the attack and the asset value which is instead decided by you. You can customize the rules, you can decide if a computer, a server is more important for you, so giving a value closer to ten.34:01Or less important so giving something closer to one. Just to give you a fun fact, customers that they worked with used to give ten to the endpoint that were containing the CEO name in the host name.34:17But this is just a fun example. Of course you can take other choices. Your server farm can be more valuable, your.34:36Employees point maybe a little bit on on the middle side. Okay let's it's time to go through an incident work through in this demo environment, you will see we don't have many integration but we have some meaningful ones. We have the.34:44And an endpoint integration which we really suggest to have without an endpoint.35:04Integration you will miss some important things. We have three integrations at networking level, secure firewall, umbrella secure cloud analytic analytics is also always there.35:10So you can see not many in integration. This, we think it's a realistic case. Many, not all customers have tens of integration, but four is a good number. And another thing.35:27You will notice our integrations here are configured in a blocking mode. So secure endpoint is quarantining malware, secure firewall is blocking malicious IPs. Umbrella is blocking DNS malicious website. This is important because we believe customers are typically.35:43Using the solutions in this way. So if you want to see the value of an XDR solution, it's better to show it where solutions are blocking and the malware is usually not able to spread so easily in the customer organization.36:03So let's go to our demo and I'm going to the incident view here, and I want to focus on the 1st incident that you see here. It has a high priority, it's named the filess malware detected by MSHTA.36:19The title of this incident is elaborated by by our generative AI. So according to the sources, you got this indication.36:38MSHTA, if you are not familiar with that, is a legitimate processing windows. It's used to display HTML based content. So it typically used, e.g., to display help.36:57Pages with the windows. And as you can see here, the main sources of this incident is Cisco secure endpoint, and you can see it from the Let let me go into incident detail. Oh, here is the the chart of this incident, we have two endpoints.37:11And both of them quite interestingly, interestingly executed similar info similar processes. A message case is colored by blue because this is a clean.37:30Process it's not malicious and but security point detect is something strange. This is a typical pattern. Many actors as you know for sure are making use of a legit legitimate.37:48Processes and this is also has a name in the security is named Law living off the land when an attacker is making use of a standard process. The detection is coming from secure endpoint, but they want to know a little bit more about this.38:04So in my observables, I noticed something strange. In the process arguments there is some JavaScript code and this is probably what triggered the secure endpoint the behavioral detection.38:24This JavaScript code, as you can see, there is something involved in the registry of the computer and this is suspicious because the code is actually taken from a reading operation from the registry.38:41So maybe there was a malware that was able to put some persistence team mechanism in the registry. Okay let's try to get more information and here I will show you how to use the investigate feature, which is here if you want to run it from the menu, but you can run it also from.38:57Our menus, the pivot menu are these small arrows that you can see e.g. here. So I want to know something more about this the IP address of this computer. Does XDR knows more about that?39:17Let's see, I am now running an investigation only on the internal IP address. And yes, there is something so interesting, interestingly, this endpoint made an access to a website that is considered malicious.39:36And how do I know this? I know this thanks to the firewall integration and here you can see the value of the firewall integration with XDR because the firewall detected this is.39:55A malicious website based on the Talos IP reputation service, and we can even know what is the action that the firewall took. In this case, I can see that it was a block action.40:12So luckily, the computer was not actually able to connect to reach this malicious website. This is good. However, I am concerned because the the fact that the computer tried to access it is not a good sign.40:28So I want to investigate more and and I will give you another example of pivoting to investigation. So I will investigate now on the IP address on the malicious IP address, and let's see what XDR knows about.40:45This IP address. Okay of course we have the similar information here, but let the investigation complete, let it reach the hundred percent because probably we will.41:02Get some information about the domains that are connected to this external IP address. Yes, and we have all the domain information. This is coming through Umbrella and through Talos, and we can see that you know a domain an IP address can be associated with many.41:18Domains, probably one year ago was associated with this 27 something, then it will registered with other ones. And at a certain point it was associated with this malicious domain. So I'm also interested to know.41:38Did any computer in my network try to resolve this malicious domain? So I could go on with the adding investigation. You you understood how it works. Now I'm not going to click on the, on this, but I want to load the saved investigation that I did.41:55Few days ago. This is also another good interesting feature. When you run an investigation, you can save it.42:15And load it again. And this investigation is very interesting because it shows me a lot of information. So this website, yes, the domain was actually resolved by.42:21A couple of computers which are the computers that are already part of our incident, these two, but there is something more, there is another part of my network which access try to resolve this domain. And how do I know this?42:40Thanks to the other integration that I have, the integration with umbrella. So as you can see, every integration is contributing to this story and to investigate on any incident.43:00So with this in just I wanted to show you there is something more in this view. I can see that these two computers also try to access the domain and t.me which is a domain from telegram.43:15And this is also highlighted here, suspicious request to telegram. So telegram is not a malicious website, but the suspicious request are due to the fact that this computer probably are not using the standard.43:35Telegram desktop application, but there is probably something different, maybe PowerShell cool excuse me, that is making access to this domain. And we have a lot more of information here that we can investigate upon. I I will.43:54Just finish my demo with another thing.44:14Let me go back to the incident view. There is a new button here, new incident view. This is something that Ruben will also talk about. We have a new kind of incident view powered by generative AI.44:21It's giving a very more meaningful graph. So in in this case my incident is quite simple, but you can see there are labels here that are talking, they are telling me executed on or other kind of verbs.44:38And the AI general KPI is helping me a lot to understand what's happening. E.g., you remember this registry key used to establish persistence? Now this is actually.44:55Showing me without the need for me to go into the JavaScript code. And there are also some other information there probably I wasn't able to was unable to catch before. E.g., the infected computer also tried to access a door.45:12Exit node, approximately 90 s before the file is execution. So this is very interesting and you can get the reasoning, information, detection, and even recommendation about what to do next.45:31So this let me wrap it and wrap the demo component and let me just summarize what I would like you to take away from this quicker.45:49Session about integrations and incidents. 1st of all, I would like you to remember the importance of each and every event and how they are giving you visibility to the exploit and the pre and post exploit phase.46:05Then I would like you to keep in mind the power of the investigate feature and spoiler alert Ruben will give you more information about how to use investigate, and.46:233rd takeaway, keep an eye on the new incident view. This is another example you can see very meaningful chart here, accessed, executed, refers to. So and a lot of meaningful summary.46:42Information here and last thing remember that finally secure cloud analytics is going to be fully merged into XDR. NVM is coming 1st on 5 May.46:59This is going to be fully integrated with the XDR so in a progressive way, all the features will be visible in the XDR portal.47:18Right, I think we we are a couple of minutes earlier, but I think we can give you your deserved coffee break now and unless there is already some question guys that we can tackle, otherwise we will take a break and.47:35Thank you very much for that. That was really, really good. Thank you. So Aspira says, guys, this takes us through the 1st session for today, so we'll give you a 10 min break. I'll put a time on the screen. Oh, actually let's come back on the.47:5710:00 or 11:00 your time, so on the hour and Ruben will start his session. So thank you very much, see you in the in a few in about 10 min. I'll post the recording now. Thank you. So Ruben, take it away when.48:13When you're ready. Okay Ary, I will try to make sure that we have the things ready. Give me a thumbs up so if it's everything ok? Yeah, we can see your presentation. Go for it.48:32Okay, thank you. So folks, thank you for staying for 2nd part. Great to see you on 2nd half. I will try to continue on the step where Pierre left us. So my name is Ruben Mayer. I'm a customer success specialist. I'm based in Poland.48:52I worked together with PR on the same team, now we currently do hybrid mesh firewall but previously we were doing XDR and analytics and boarding multiple customers on this solution. So the TDR block is quite back coming back home and we are gonna now covering a bit more the track detection.49:11In response on 2nd part and we gonna try to give it a slide upper gear and we gonna try as well to automate some of the tasks that were previously seen in the 1st half, and for beginning this second part, I will try to do with you a.49:32A short refresher of what pierre covered on the 1st half, and we will start with some common some common terms for the platform that you should do by now. So anything that we.49:51Anything that we have on our platform that by now you should know as an event is anything which generates a log an alert or an alert, it's an event which meets the criteria for concern.50:08An incident is alert or series of alerts which are indicative of a breach, and then we have the observables that are any discrete item on which one can search. So the thing the same thing that was done under investigate and an indication an indication is usually a series of events or behaviors that can be indicative of a brea.50:23So this is just a short criteria of a short summary of what we saw in the 1st half. And a second refresher for this will be how does the incident generation pipeline looks like on XDR? So I know this slide might be looking.50:43A bit overwhelming. There's a bunch of pieces here, but we're gonna go slow. So, 1st of all, we're gonna take a look on the left side of the graph. So in the 1st piece of the diagram, we are seeing all the telemetry sources that are being ingested on XDR. So this is important.51:02Because it's all the data that actually arrives to the XDR warehouse. If you remember when Pierre was showing that corn view, he mentioned the part of the data warehouse and that's exactly where these ingest modules are pulling this information and adding it to our data platform. We.51:22Generally are concerned about two different types of sources. So the 1st part comes from our detections and 2nd part comes from our network telemetry, and they can be coming from multiple sources as well as peer covered. It can come from the network and we are talking about cloud flow logs netflow.51:42Endpoint we talk about NVM, nowadays, we can even talk about the AVM which is the new agent, firewall we are getting the logs, cloud logs and identity information all together we can get them.52:03Into our platform, normalize those events so they are converted to the OCSF format. If you're not familiar, that's the new way that Cisco wants to go broadly. So we want to adopt the open source standard for incident format. And we are trying as well with 3rd party integration.52:17Is to allow OSCF events to be ingested in our platform, to allow our platform to be more flexible and more open source oriented. Then after we get all those events normalized and reached and then.52:37Correlated, we start what we call the incident generation. So the incident generation is when we start to correlate events to create an attack chain and those finds to be correlated on the attack chain can be based on a.52:56Observables, and an observable has to have one relation between a shared relation between an address, an IP, a device, a host name or a username or a file hash. It has to have a relation between multiple sources.53:12So then we can enrich that incident and create the full attack chain. After the attack chain then is created, we go through the evaluation summary and the evaluation summary is the process where you apply the AI summarization that you saw PR showing on those incidents. We will see it later as well. The AI enrichment is done under that.53:31Parts on the we are already on the last mile and then we are giving this in prioritization based on the asset score and risk.53:51And then if we want them to take an incident to query for more data and get to know a bit more about should we collect money forensics evidences or not, we then can use the XDR forensics module to gather more evidence, to enrich the incident, and then we can use as well.53:59Orbital to have our endpoint open as a data queryable database and do more queries and do script remediation. So those things will be covered on day two by Thorston, a bit again on the XDR forensics in the orbital side. And this is also all the time.54:18Leverage through the APIs.54:39So, this is the refresher for the 1st half in general, and now we gonna start to move the gear into the response part. So for the response part here the the criteria that I decided to bring was ok let's.54:42Now take a look on this on how is the main audience or how's the main.55:00Targets for the the response part. So we are mainly talking about the sock analysts and we are main talking about how is the day spent on the sock life. A soak life can be very cumbersome because there's many tools and many logging sources to collect data from especially if we don't have.55:06A solution like XDR. The moment that we are able to get XDR into the play, we are literally talking about starting from atomic alerts, your daily basis yes tomic starting from atomic alerts still can go home. We are talking about.55:25XDR automating the 1st part so XDR will scope the incidents, investigate the alerts, correlates the events and enriches that data, change the incident, and then prioritizes that impact, and this event scoping can be done in 5 min.55:45And you can think about that as an enrichment of ten times the more tickets that you can actually take a look on per day compared to a human going through all that data. But the most important part is that the SOC journey starts on the validation side. So we are already starting from a point where we.56:02We are evaluating collected data collected artifacts and decided based on actions what we gonna do as the next steps.56:22In case we need to respond, in case we need to do a recovery or in case the attack is contained, XDR will provide us a guidance if needed, and this it can also be automated, which is quite cool. What we are seeing here is now you're gonna spend most of your.56:31Nine to five unite shift depends on doing spending your working hours on doing validation to a response rather than spending the full day doing alerting to get something plausible and then investigate and maybe you cannot still even do any response.56:49It's because you may still are days ahead of knowing if you should respond to something or not because your previous data is not yet even correlated on any hypothesis.57:09That can get you to an incident yes, so your full working hours will spend on validating and responding, not any more dealing with the, all the collective data that you need to do to even get to a point where this event is scoped and you can start an investigation from.57:19No.57:39With that in mind, and we know there's a coin model for socks done by sand. We actually decided to design something in our XDR platform as ground foundation of our playbooks to respond that they align with the sense for 500.57:40For B-B, that creates all the steps from.58:00Preparation till lessons learned for us to be able to contain and respond to an incident and learn for the next times that they may happen. Knowing that and knowing that here, the main point that we want to do with XDR is putting on a point in time where you are already the.58:06Manager and you are managing incidents. We already starting from the detection side of the house, so preparation is.58:26Fully excluded in the lessons learned those are given to you to do at your own time, but you start all the time from next year already on the position of identifying, containing, eradicating and recover, so we are reviewing the incident and confirming the findings. We are acting on the impacted hosts. We are.58:33Remediating vulnerabilities and removing malicious content and in the end of the day in case.58:53We need to restore some service, some impacted services. We'll do that and we validate that remediation. So we focus more on those actions and then we can open taking those actions on XDR then, you know, design our playbooks, learn our lessons, how we can even you know.59:02So expedite more of the operation with next year in the future.59:22So those those key points then keep those in mind and then continue to iterate as long as you're utilizing XDR and and improving your XDR overall experience. Now in terms of architecture, so overall architecture on how the xdr.59:25Our automation works, and we already covered part.59:45During part one is we have a variety of live actions, but there are different ways to start those actions. So we have pivot menus that they will act on an observable in the various places within the XDR or other Cisco security products. We also have the respons.59:50Playbooks that will take a look. And the playbooks are built in guided books that are designed on those core.01:00:11For core fundamental pillars that we mentioned before, those four stages or you can bring your own playbooks, you can design your own playbooks. We're also gonna see that in a moment. And then you have the automation workflows. So the automation workflows are simple or complex that can be used to investigate.01:00:18Get or respond to an incident at machine speed and there are different types of events as well that can trigger those runs to to execute. And of course, all those are only possible with integration modules that then will do the communication to the product APIs and respond to those.01:00:38To those products according to the actions that you are taking. So you can take, for instance.01:00:58Using a pivot menu to take an action such as isolated host, block an IP on a firewall, block a hosting on the DNS, quarantine messages on the mailbox. Or you can also dictate that if something happens like that, please do automate that action. So we can also automate certain actions to be done.01:01:04On our behalf.01:01:24So in terms of native response options, as I mentioned again, pivot menus we have those that can be leveraged from any, any element. The playbooks and automation. Here there is an example on the right side of how.01:01:29An incident playbook looks like from the incident perspective.01:01:49We're gonna take a look around those those actions, and you can see here already from this image on the right side that some actions you can generate with AI. AI will produce a note, but it will require you to produce an actions.01:01:54So there's always still the human in the loop that needs to go there and check, hey, listen, here's our findings, here's how the generative way I looked at that incident. Here's there's some still some here there is some still.01:02:14Feel that can be edited. Give give as well based on our observations, your opinion. So the machine also does the analysis but still asks you based on those observations and steps that you eventually done as well.01:02:34What's actually the final verdict if you want to to add that yes? So you can, you can be all the time on the loop of those actions. Then there are others that will auto complete and others as we'll see that will maybe failing and that's the reason why I left this image here. We'll show that.01:02:50That as well because those will require the integrations to be set in place and we will see why.01:03:10In the demo section. Again, referencing again the pivot here just a wider view on how it looks like the same example that was covered before, and here I'm actually highlighting one of one click.01:03:17The Automation that can be done. So for instance in this case here we can see that.01:03:37If we pivot into that device and specifically select the IP as an attribute, we can already run an automation such as added to umbrella, assuming again, like was covered in the 1st half that you have the umbrella integration already set in place for this automation to function.01:03:41Or if the orbital agent was installed on that machine, you can always query that machine with Orbital. You can do other actions as I have here on the left. You can create your own judgments, you can click to go in investigating that observable.01:04:01Alone, like PRD with the IP investigations on the 1st half, you can link it to other products to view additional information. You can take a response action as we'll see from the playbook or you can as well.01:04:20Check if you have an additional context automations that you created or add this to a case. Let's say that this IP address in itself would be part of one of your cases that you have investigated, you can create an investigate case and I.01:04:35This IP as one of the observables that you want to be part of that case.01:04:55The part of the playbooks. Again, these playbooks align with the piece of model. The idea here is to bring you the ability of taking immediate action.01:05:00And you are taking the role of the incident manager. So out of the box XDR already comes with some automation workflows. We will also take a look on how you can create customized playbooks and apply where they are needed. They are broke down again in those four categories, and the most important.01:05:17The part is you can also take a look on when you're doing automation, all those actions that are taken by you as the investigator and you can see my name on the right side.01:05:37So RM is my initials. Actions taken by me. You can see the timeline from 14 of April till the 20 of April, where was my last latest action, and those are done through automation just by clicking on that execute button. Yes? So we can keep track of what an investigator.01:05:48What it was doing in case we assigned this.01:06:08Particular investigation to another user. The actions taken by me will still stay there and then the actions from the subsequent investigator will be added there, so we can keep a timeline of as well actions taken by the defenders. We can then Indian think a work log out of it.01:06:10Last, before we jump into our 1st demo.01:06:31In terms of custom playbooks, this page changed a bit, this layout, this used to be called totally different. You only have the edit option. Nowadays, what we have on the playbooks is when you are creating a custom playbook, you are giving two sets of tasks.01:06:341st is you want to create tasks that then you can assign to a playbook and then you can assign that full playbook to be your custom playbook 1st and then fall back into Cisco predefined one. So you are able to create response responsibility.01:06:53It is based on your capabilities, based on potential automation tasks that you created and imported through GitHub or other sources.01:07:12And you have this ability to dynamically assign portions or conditions to to specific events. And when I say that is on the assignment rules, you, you can actually put a playbook running when a certain event happens.01:07:22Prior to defaulting into the Cisco provided one yes? So let's let's 1st of all take a look into the playbook response and just get the general idea how the playbooks look like.01:07:39So if we jump into my XDR playbooks will be under administration playbooks and I'll actually do control plus I'll try to put this a bit bigger. And here I have already one custom playbook then by me, but there's also.01:07:57The.01:08:16Cisco default one that ships with the box. By default read only, you can duplicate it, you cannot delete it because by default this is your main playbook. Everything will default to it. Then yourself as well, whatever you create as custom, you can set it as.01:08:17Default or you can delete it up to you. For this example, what I did was I duplicated the.01:08:37Custom one from Cisco, and I started to tailor my own playbook. The most important part here on the playbook is if you want to create a custom playbook, there are, and you want to modify certain steps of the playbook.01:08:44So for instance, if we edit the playbook and we want to add a specific condition on identification contentment eradication and recovery that is fully customized by us.01:09:02We need to add that as a task, and then we want to make sure that it was created by so. So completely custom. There will be cisco management you can hide them, and then anything that is here that it's not.01:09:20Cisco predefaulted one from XDR. You can then utilize and you can customize or you can create your own tasks. But you cannot start to make something here without having having a task behind it. So for instance, if I go to containment, you can see already that on my.01:09:35The Containment playbook, other things that have containment as tasks.01:09:55And that already assigned on the book are unselectable. Yes, they're grayed out, and that's completely expected. You can remove it, it will become active again, and you can take a look on what it is doing, which is the most important part and why this is important because.01:10:00If an automation fails, you may find out from the task itself if it's fault of you not having that particular integration or if it's fault that your orchestration workflow is wrong and needs to be corrected, many things can be identified as potential misconfigurations just from.01:10:19Analyzing how, a particular task works. So this particular task in general doesn't have an automation task behind it. It's mostly just analyzing things towards how.01:10:40Comparing incidents to the pyramid of pain. This one is for the for the overview of the of the IFC so we can add this task to the playbook. For instance, this one.01:10:55That contains an IP address or this one that contains domains, this they have automations behind it. If I remove that one and if that does a task, again the same steps, we just add it and then we go here.01:11:11And we look for the contain, so let's remove container IP addresses and check here. So as you can see here, this one has an automation behind it and it's telling you which workflows it's utilizing. So this workflow.01:11:27Consumes one or more IP addresses and attempts to block them on supported products. Those supported products can be.01:11:47Secure access umbrella or XDR intelligence feeds yes? So you can see that if any, and I'll cancel the changes. If any of those things will fail, we have to take a look either on secure access integration, umbrella integration or.01:11:54Then rely on just the XDR field for that matter. Now, the last thing here is the assignment rules, and we just gonna take a look on how this aligns. So the assignment rules are basically like.01:12:13A set of conditions where you want to create a rule for a specific use case, and then you can use your custom answers to it and then fall back into the Cisco default playbook if your main actions are not sufficient or not matched, they will land on the incident playbook, so.01:12:28For instance, you can have different playbooks for certain types of incidents that you filter from incident queue, and if none of them is matched, by default, what is being used is the Cisco.01:12:48Ship that ships with the the tenants yes, the Cisco playbook. And where are these playbooks doing all these automation? They are doing it under incidents yes, so if you take a look on any of those incidents, I have these two here in particular.01:13:01And we check the incident details. They all be visible on the response and that's why how we start to work on. So here covered the detection parts and here I can also go briefly on the detection part. Most of the events that are coming from this particular detection.01:13:18Are coming from secure endpoint and then we could then evaluate if there is another source then matching this particular detections. You can also check here from sources which ones are contributing to do so, and you can filter as well by severity and.01:13:36Here will be the if they were investigated already or the original under response if you go back under response so these were the playbooks, right? So, NO, so far I didn't took any action. As you can see here actions taken by Ruben Noon so far, yes, so you.01:13:55You see that AI already generated.01:14:15A detection type, a title based on the detection type. This case aligns with framework for execution. We already have an AI generated summary, so a non malicious file was executed. And we also can then review the incident. So before before we start.01:14:19Start with anything. We can also use the.01:14:39Generate notes from AI to do a global generation of that event and yet this part is not touching yet on automation. This is just touching on the AI agent part, generic AI doing generative AI doing the, the review of the incident.01:14:42It will create take a bit to create it will do that and then what I will do next is, so action required, like I mentioned before, I'm gonna be the human on the loop. These are the IOCs that were found.01:15:03On my machine, this is the list of all the IOCs that were found and this tells you something. So tasks that were performed was it that all the assets were reviewed that are involved in this incident, they validate the detection based on.01:15:18On my ash that is a true positive for a malicious behavior. So we also analyze ambiguous and incomplete symptoms, so we don't aren't fully sure yet about the nature of the incident, but we record the evidence and the reasoning to support the findings. So.01:15:35What, what is still missing today to allow this thing to be finished is our headridge from our end yes? So we can also say like, ok, based on this analysis I, we have some dispositions already, something is malicious.01:15:51All the other parts are unknown, but we can already to certain degree, take the conclusion that if this hash is malicious, probably the likelihood of something beings executed is positive. So for instance, on this one, I can call it out as.01:16:12As a true positive yes so I can have a note and here I'll say, add the note and set as complete. And then that this note is already added then you can click your review notes and.01:16:29The worklog will keep track of everything we did. So based on that, we still didn't define it yet, but we have a worklog of the actions that are already starting to be intake on our worklog, our worklog, again we'll maintain all the multiple interactions between investigator.01:16:45And the enrichment of all the investigation throughout people working on the same case. Now, how the automation will chinese? For instance, let's say now I have one on one automation that will.01:17:05Do this part of the house like the that will do the confirmation of the incident, but that will take a look in the brief moment. Let me bring you back to, to the automating response. This is the next part that we gonna touch base. So.01:17:23To automate the response, and this is how automation works in our platform. So initially anything that is automation is based on automation rules and any event that triggers automation rule that can be an incident that.01:17:41An alert webhook will then trigger a workflow to execute.01:18:01Those workflows are activities that have step by step next actions that will be executed through a pipeline, and then they can in the end, send notifications, create tickets, isolate hosts.01:18:07Quarantine hosts, and then when you have that result done, you can schedule on demand for certain type of events that happen with this pattern, please do get them scheduled. Please execute without.01:18:24My overseen, do it on my behalf with the scheduling yes, so for certain things like, a common use case that you can see here would be an integration with Webex where a new incident comes into the pipeline, your, assignment persons to that incident will receive a Webex notification.01:18:41An incident room is open. You build a war room response based on that Webex room. You put the people in inside of that Webex room and then you can start your war room decisions and take more actions towards towards that particular incident.01:19:01If the case maybe. This is how it kind of looks like in terms of what the automations are doing in terms of like workflow, you have this canvas that is a nold two local approach. This has been for us since a long time if you still are, you know, NO.01:19:20This component from Securex days. It's still the same component under XDR.01:19:40With more APIs than before, you still have the old canvas and you can build all these playbooks step by step, create those actions that are pre written workflows that come with XDR, but they are not limited.01:19:45Okay, my audio failed for a second. Sorry. They are not limited for the XDR.01:20:05You can also bring your own particular use cases Yes, you can use this canvas to orchestrate other workflows that talk with, you know, HTTP servers to do query for information query HTTP targets, so you can use this as well for working with other APIs.01:20:11Now, this, if you remember this from the other days, this used to be called triggers, now this is called rules, and essentially it behaves the same way that triggers used to behave. You have various types of events that cause workflows to run.01:20:36You can have approval tasks that is accepted within, acted in within the XDR automation. You have email rules, incident rules, scheduled rules and webhook specific that an HTTP call has to be made to a specific webhook URL to be triggered.01:20:51So the same, the same automation rules that used to exist now with a new name called rules instead of being called triggers like in the past. A cool thing that we introduced the last thing before we jump again into the XDR.01:21:11Demo is the automated exchange. So the automated exchange you can think about it as quote unquote automation marketplace, though it's free. I'm just comparing to other cloud platforms yes? So this exchange is like a free place where you can find.01:21:28Find the install automation workflows and they are divided by.01:21:47Four different types. So you have Cisco managements that are authored by Cisco and they are included in system workflows and atomic actions that are supported by TAC. Usually those you gain them when you integrate your products, and then additionally you can install some subsequential ones that don't exist.01:21:52Those are done again through APIs, so they leveraging the product APIs. You have Cisco verified ones that are outered and supported by Cisco security technology partners. We have more than 100 and we work closely with them to provide you additional.01:22:12Integrations here with the workflows. We also are supporting our community of devnet on the best effort basis as well trying to bring community support workflows. These are dependent on the license.01:22:32And they are supported again on the best effort basis. And we also have the 3rd party ones. 3rd party ones, you can think about you yourself designing your own ones on the canvas and then send it to your GitHub, but then sharing with some other folk and other person importing on their own organization through GitHub.01:22:48And importing and installing it under their XDR tenant, so you can also use 3rd party integrations and calling it my like bringing your own integration. Now I'm gonna jump back.01:23:08Where we stayed, and we're gonna try to touch the dots of those two parts. So I'll go to automate and then I'll bring back to the, to the incident to make sense of all of this.01:23:26So I want you to pay attention to two things here. So workspace is now, the, the main tab of workspace these days now is the getting started and it also has what they have on the slide in terms of how the automation works. But don't take the word by me in terms of the value alone. You can also watch.01:23:41This video on the right side that it takes 5 min to watch, you can watch it and it also covers the full workspace area and how these things work together. The coolest thing that I was mentioning before is.01:24:01How you get started, you have all of these ways to to start the workflow. You can browse the exchange, import from Git or start from blank and create your own. But if you also want to take benefit already of what you have, you can check your connected integrations.01:24:15And you can see how many still workflows are available for the products that you already integrated. And then here I think it's your biggest value is to leverage already from the automation from the products that you already are consuming. So for instance, from all of those, I.01:24:35You can see, still say that for certain products I'm still.01:24:55Not so much into automation. For instance, if I take the example of secure endpoint, I still see here that I have more than ten workflows that I can still install that I'm not making use of. So for instance, if I wanted I could install this.01:25:01Isolate hosts. It's so simple as click here, it will take use of my API credentials from my secure endpoint. And then if I want, it's already asking me, do you want to automate it? And to automate it, I need to create an automation rule name that will utilize.01:25:20Is it, and for instance, I already have two, two automations there. If I wanted to automate one of those rules I could just put it here, put continue, and then just add it to there. And then as simple as this. If I have like.01:25:40A rule where I know that I can make use of an additional workflow, I can as simple as this as the for instance, the installation of host with secure endpoint to that particular rule. And from now on, every time that rule triggers.01:26:01The secure endpoint API will also be called and if our.01:26:20If the need maybe, the point can be isolated. Now, if we go back to the workspace and scrolling all the way down, I also want to to make sure that you.01:26:24Of course, this is a short period of time. In 1 h you cannot get all these things covered, but in case you are still a bit lost and you want to learn more, please take a look on the resources from learn more. They are interactive and you can learn way more. There's a FAQ on how to build stuff and as well.01:26:41The part from the understanding of the documentation. So this learn and discover is also best place to start again with everything that you already have. Now, when you do an integration, you probably already noticed that some of the products that you integrate, they always create.01:27:01An integration targets yes? So when you build an integration, like when you activate an integration, a target will be created based on on that integration. And you can see here that some of those products are integrated, they will have.01:27:18An API and that API was created the moment that you established that integration. So this API targets will be what will be then consumed by the workflows and you need to have those APIs available in case you want to run workbook automations yes from the response, from the respons.01:27:35Phone's perspective, if you want to run actions.01:27:55Those integrations have to exist for you to be able. So for instance, a cool, a cool one. So I have an integration with Webex and we can, we can go here and check the integration with Webex quickly. So if you go to here to my integrations, I have an integration with Webex.01:27:59That is essentially just a bot, and I call that what XDR alerts notifier. So, and I said like ok with this integration of this alerts notifier, what I want to do essentially in terms of automation is.01:28:19I want to make sure that when an incident comes and we go here to the rules, when the new incident comes, I want my an incident to alert me on Webex, so here when incident status is new.01:28:39We trigger this to create, send a measure message on Webex and I also actually added another one for for to query for an incident assets, but it's not particularly necessary for this type of automation. I can also remove it. And here as you can see here, we are using.01:28:59This is the Webex room that we need to define, and if a new incident comes in, I get notified, basically, and this is going for any new incident. So previously.01:29:18While we were still doing the warm up, I was generating incident notifications and this is what lands into the XDR. Please confirm that you can see my XDR guys, sorry, my Webex.01:29:34Yeah, we can. Thank you very much. So this is the automation that comes into the my Webex, as you can see here, the only people involved at the moment is me and my Webex bot. These notifications come from my incidents.01:29:51Where a new incident comes in and NO person is assigned to it. And what then I can do is I can.01:30:11Click on view this incident, and it's probably gonna open my firefox, but you get the idea it's the same incident yes? So it will take your preference browser and it will open it and it will get you into that incident. Why this is cool? Because those incidents don't have anyone assigned to them.01:30:19Yet, so it's quite important to receive these notifications and because I'm the only person needing this automation, that's why I'm the only one being alerted. So I'm the only stuff at the moment, but I get those, and at the same time.01:30:39If I have findings from other sources where I still have as well about, this one can be configured as well from the cloud analytics perspective. You can also get alerted from findings from cloud analytics because cloud analytics also support.01:30:59But the integration for findings that come from the network perspective.01:31:19And because I'm the only one there, at the moment, we're gonna take a look again on the same incident and we're gonna start to respond to it. And 1st of all, if, if we are starting to do an incident and we want to take.01:31:25Triage and start working on it. We 1st have to assign ourselves to the incident. So for instance, if an incident starts to be actions are starting to be taken into an incident but there's NO one attached to it.01:31:44The likelihood of that incident to be then taken over time might not be enough. You need to be there there as an active active person into the loop. So for instance, if we say like, ok, one, want to update the team.01:32:00Ticket and create a room to start the triage for collaboration, and if I click on this execute, this thing will partially fail and it will be partially failed.01:32:20Or be partially completed because since there's NO person assigning to the ticket, the automation cannot create a chat room because the incident has NO assignees. So what we're gonna do firstly is we're gonna assign ourselves.01:32:31As the person investigating this incident, and let's again now start taking some automation out of this. So if I execute and I want to ok confirm this incident this incident is actually something that I need to.01:32:49Start to triage but I need more collaboration because I may need more second health to chat and to have some other view about it. Now that it's completed, I'm added to the room and.01:33:05A Webex, a Webex room with his title was successfully created. Now I can tell you that it is because I already received it in my, in my Webex, and I can see here that.01:33:23This is a new ticket and it was performed by the automation. So as you can see here, this also says collaboration for next steps and remember to have notes to the incident workload from actions taken, and now if I wanted, I could, for instance, go here.01:33:40As people.01:34:00And invite PR and not PR to the room, and then I also have here and I say hey Pian. Yes, so I can take take a look on this and I can start collaborating with PR straight away on this particular plan incident.01:34:01And so thanks and then you can see the actions taken here on the left side, yes, so as of now, we only started to begin with some stuff. We didn't done anything for concluding any.01:34:21Any operations yet, but we started already kind of a war room which identification part. Now, let's say that I want to notify and create a ticket.01:34:39I could, I could, and I could create this to notify a platform about this particular incident. But the thing is, in my particular case, it will fail, and that's why I put this on the other side as well, and why this thing failed because.01:34:54A workflow will always fail if an unsupported product for this particular orchestration is non existent. So if you don't have that product, in this case will be, this case will be snow, so ServiceNow or Zendesk to create tickets to document and notify.01:35:11That integration has to exist initially so that webhook and that integration has to be created in order for this document and notified to work. And you can also take a look then from the workflow perspective.01:35:32This will point you to that workflow and it will tell you that, the automation workflow, why it failed. So this is the overview of the notific of the run itself, why the run failed. But if you also want to take a second look on again on the playbooks and go for tasks.01:35:47And then go to document and notify. It also will tell you here that you need to have supported integrations as a ServiceNow. They have to exist initially for you to make full use case of the full playbook. So what I do recommend you is, in case you want to take.01:36:07Those automated actions, go and take a look in some of them and check what are the products behind them before you start to fully try to automate the full workflow yes?01:36:27You can take certain tasks with automation, but be sure all the time that you have the prerequisites before, before doing them. So 1st key takeaway is understand the playbook before you actually.01:36:40You actually try to get the benefit out of it because all these tasks, again, like I mentioned on the slides can be automated. You are in the validation stage, you are in a simple one click position of taking actions and.01:36:59Prioritize prioritize your investigation yes, in terms of response. So we could continue doing containment if that's the case and continue generating and identifying vulnerabilities and other parts and those will be still kept having on the workflow.01:37:16On the work log, and then in the end even generate the report where I will generate the full report from the full part of what we then under under the response. We also from here will have the.01:37:34Investigation enrichment, but we will touch base in the moment on that and we will do the full, the full scope out of it if it makes sense. So we're gonna go jump back.01:37:51Just quickly takeaways of that before we go to the last section that I want to cover. I'm cautious about the time as well. So these are the key takeaways in investigate, respond and and simplify and.01:38:06Integrate so does the for keywords reduce your time to investigate by automating one click responses, we simplify the the need of repetitive tasks and we're just trying to bring all the products in one.01:38:21One place where you can use new ways to respond to emerging threats. So for the last part, and I think it will be till top of the hour, we're gonna try to make.01:38:36Connect all the dots. So here on the threat hunting part, I will start with a different example, but I want to say something about what already started to do on the investigate part was already something that can be proactively done as threat hunting based on those observables and the.01:38:52And try to go deeper and deeper and try to evaluate each single one to see all the enrichment being built and all those points.01:39:11Attaching together. And that can go into response maturity, yes, and I wanted to talk about this because I wanted to actually bring these slides in because I think XDR can be pointed into different types of maturity in terms of response. So you can be sitting on the.01:39:20Active.01:39:40Incident response which is the traditional. So let's say you have this high alert fatigue, you have civil tools and you have delayed time to remediation. What XDR can help you out is the unified visibility, the orchestration, and you get this accelerated time to respond.01:39:41When an incident occurs and here you're just being reactive and saying ok an incident came, I'm looking into it, I'm responding, that's it. Point. You're just responding to alerts. When you're moving your brain into proactive and you're being more strategical.01:40:01You are focused on threats hunting, vulnerability management, and preemptive hardening. Your advantage is you are identifying and neutralizing threats before they actually impact your environment. And here at XDR is making the role will be like it's using all the telemetry across the network and point and cloud.01:40:21To identify the patterns of the OCs before they escalate. But then how about then when you grow up again on maturity and if you take a look into more about bridge simulations, you can also utilize XDR as a.01:40:40Support.01:41:00To your purple teaming to continue to iterate on continuous bridge simulation testing to make sure that we can improve our response playbooks because that might be the case that, ok, Cisco playbook is a nice foundation, but I want to respond to other specific things and I want to create.01:41:01As I I show you, my own custom responses to those particular threats might be the case that I need a specific playbook that just goes and neutralizes that type of threat. That might be another materiality level that you can use the XDR to work on. So don't think about XDR and just.01:41:21Your view into react. Try to also be proactive and try as well to escalate and test more things, more tooling and do continuously tests pretty simulations and make sure that XDR can be part of it to optimize your your playbooks.01:41:43I'm gonna tell you a story, then we land into the demo to finish yes? So one cool story is about Kubernetes, and we know that Kubernetes have been kind of highly abused especially last year with the React to shell. And we also saw an increase on those attacks I was reading a news.01:42:01Yesterday of around 250 % over the last.01:42:21Quarter, last year on the attacks done to Kubernetes and how, how the problems happen in the Kubernetes and usually it's like someone is trying to learn Kubernetes still on 2026 and by default when you're learning Kubernetes you are setting stuff with default credentials out of the box.01:42:26Or you're putting over premissive role based access controls. So you're granting admin access to the cluster or you have.01:42:46Simple as an exposed service that you are accidentally exposing a web app and that can be the the entry point. React to shell was that case that the entry point was a vulnerable web app that had the react component that was then abused and it.01:42:55It started as an entry point yes? So all of those things are misconfigurations when you learn want to learn things fast and deploy lab and put it up to speed, your machine will be vulnerable because by default when you want to learn something new, security is last the last thing you do.01:43:15If you are trying to expedite a project, you want to test it quickly and maybe security might be overlooked and then that's where things may happen. So from a small, a small error it can lead to a breach. We saw that happening in the wild that.01:43:34Apps were being abused, that exfiltration was happening and then resource hijacking as called or actioning the objectives was done and the malicious actors were installing crypto mining tools or abusing the cluster resources. So as an exercise, and I'm not.01:43:52Wanna fully cover how the attack was made, but give you an idea on.01:44:11How that event that I have on my XDR looks like was I actually did one breach and attack simulation use case that was an exploit facing application that was running on the Kubernetes cluster was vulnerable. It allowed myself to upload the websion.01:44:17No, I did a complete remote code execution. I was able to escape the container. When I went into the system, I installed an agent that called back to call better and then I automated a few tasks from call better side.01:44:37To be done on that specific host and then to what i'll move across. Of course, disclaimer I'm not gonna show the technique on how it was done, but I'll show you how to connect the dots on how we can investigate then that incident on on XDR.01:44:53So this was the incident, this executed malware you see. What I did on call data was if you're not familiar with call better is a framework that was done from my ATK, so.01:45:14Calvera is essentially an adversarial tool emulation and adversarial emulation tool, I'm sorry, that you can emulate an adversary. I created the custom adversary for Kubernetes that uses a pertained set of techniques and all those.01:45:32Techniques I run it against my cluster through that agent and this is kind of the operation how it looks like onto some techniques that work and others didn't work because those services weren't there, but this is just to give you an idea how you can simulate.01:45:52Again we are particularly starting from the point of the assume bridge. That's what you do all the time on bridge simulation, you always assume the bridge, so an agent always has to be installed there to communicate your.01:46:10Common and control framework to then on the common control framework, you execute a certain amount of techniques that you want to execute on the endpoint and then trigger stuff. That's how we did for for this particular incident. Here I only have security.01:46:24Point detecting.01:46:44We can view this investigation with the enrichment and this is how to enrich parts so again like was said from, like was said from here before, here is the the things that I have as suspicious is my server. The.01:46:46From the malicious processes the agent from that was deployed as well I attacked the controller before, so the controller also saw that agent because that agent already run that in the past.01:47:07But at the moment the for the time frame, the target was my node one. So the node one was the one that was infected now, and the K controller was there present before. So you can see on the time frame down below.01:47:19The the timeline that we now enrich this incident but according to the timeline, some incidents were already seen before on the on the controller itself. And here we can then we can then take a look on and then we can apply.01:47:38Actions in one click. So before, before there was the 1st agent that they deployed I called it, 2nd agent that deployed called many cubes, and the investigation was already investigated for, for that particular one that I could one click action.01:47:56Check here that for the current investigation time, it's malicious at the current time is also malicious, so we can see that they didn't change over time and for certain endpoints we can see the indicators.01:48:16And just making you aware that we are on the hour now. On the hour, yeah. And then of course apply, apply the actions. So this is how we can connect the dots yes, I know and I just have one slide to finish. This is how we connect the dots and how we can continue to, to investigate and.01:48:33And the automations, the automations then you eventually will go to containment.01:48:53And apply isolation to start to work and verify what's been done at that endpoint. But last to finish completely to wrapping up. I just wanted to bring you to the last one, which is, this is a message, a personal message to you. So don't wait for the.01:49:00The bell to ring and let's try to re image the other model with XDR investigate. So with the investigate module we can try to think about we can leverage Talos feeds.01:49:20To take a look on starting like our endpoints or some patterns and formulate the hypothesis, then he reached out to investigate module to see how we can see it in more details like was doing. We have the way to uncover which will be our visual graph that we can uncover and see how.01:49:33The blast radios around our hypothesis and what is malicious and what not, and then.01:49:53In terms of inform and in reach, you can think about in one click action that you can classify something as malicious, and in one click XDR will inform all your security stack about that threat intelligence and propagate that malicious.01:49:59Sha across other solutions that can block such as secure endpoint or secure firewall for instance and contain that threat before it starts to blast everywhere. So effectively you can use the older loop and reimagine around XDR.01:50:15And that's it. And sorry for the additional minutes or two and thank you for your attention and your time today. Thank you. Wow. Thank you very much, Ruben, that was amazing. So thank you everyone for attending.01:50:31Apologies once again, yeah, we've gone a little bit over. So please, this, last session today just wraps up the 1st day. Please join us on Thursday for 2nd part of this series, which is gonna be with Torston.01:50:47So please just be aware of the time zone. I think we've had a few people, you know, just confusing the time zone. So 10:00 central European time or 09:00 A.M. UK time.01:51:06So, with that said, hope this session was, useful for you, hope it was of value and we shall see you on Thursday and thank you very much and enjoy the rest of your day.01:51:21