Exploring Cisco XDR - Part 2

Oh good morning, everyone, and welcome back to day two of our Cisco Expert insight series on Cisco XDR. So we will be starting the.00:00Today well, on Tuesday we had already a fantastic start to our deep dive into the platform. We covered foundational overview and integration of Cisco XDR, and we explored also the critical workflow for investigating and responding to security incidents. I hope you found the.00:20Sessions as insightful as I did.00:40And today, we are going to build on that momentum as we shift our focus towards proactive detection and advanced response strategies. So it's my pleasure today to introduce our speaker, Torston Hans. Torston is a distinguished speaker, and he brings a wealth of knowledge to our discussion. He will.00:42Be leading us through our two sessions today. 1st session will be detect threats.01:02And with Cisco XDR it will start now at 10:00 A.M. and then we will have a short break in between of 10 min and then it will be followed by 2nd session which is respond to threats with Cisco XDR at 11:00 a.m.. Thorsten, the floor is yours.01:07Thank you, thanks for the introduction. Yes. Hello. My name is. I am a technical product manager now, previously the role was technically marketing engineer. I have a long history in endpoint security since a lot of years. Let's see and.01:25And today, can you see my PowerPoint?01:45Yes yes great so today I want to give you a introduction or a deep dive into Cisco XDR and threat detection and response. So we have two big parts. One part one is how we detect where we go with, with XDR, how it works, one is base telemetry and.01:49So on and then on 2nd part we will go into how we will how we can respond to threats. Just want to give you a note here. So there will be a lot of very noisy slides. So the idea is as we are sharing the presentation in PDF format afterwards, you can use it as a.02:09Right and going through the presentation again.02:29Okay, let's start. That detects that with XDR. Before we go into the content is there have been a lot of discussions about is XDR EDR plus plus or how we go ahead with EDR and XDR within Cisco. So.02:32XDR is not EDR plus plus, and I think this will be super clear after this hour. So the vision of XDR is that we bring more and more things into XDR. Will XDR replace EDR? No. So EDR is our.02:49One of our big foundations for XDR. On the other hand side, if you already know some Cisco products like XDR analytics, we are already in a change moving more and more parts of XDR analytics into the XDR UI. We are already working on how we bring orbital.03:09Our query and response tool into XDR, so we are really constantly reducing the amount of UIs. The goal will be that you do everything with XDR and how we, and even how we describe incidents or generating incidents with AI and so on. So, but this will be will be all clear after this session.03:30So, what we want to do with XDR, right? So we want to integrate email, network, cloud firewall endpoint identity. So a lot of sources, and it's not just getting an incident. What we want to have is getting telemetry from all the sources and then using our XDR.03:50Analytics engine to generate.04:10An incident, how the new incident will look like and I had I have added a lot of screenshots so it will be super clear. For Cisco, when we are talking about Cisco and endpoint. So it is not when we're talking about endpoint detections, it is not EDR only.04:13Really Anymore. When we talk about endpoint and XDR, we have secure client and then we have five modules which are already.04:33Related or mainly related for threat detection and response. After this session what the motors are doing and if you're completely new to our concept, everything will be clear for you. No worries. And please don't care about the names, you know, we are confusing, we have a lot of names, but it is super easy to understand. So.04:41For anyone who never heard about secure client is so what is secure client? Secure client is.05:02A framework which is cloud managed where we can put modules into it. So we have started with securing connection with VPN and CTA, CTNA we do posture checks like, oh, is my endpoint?05:08Compliance so it is allowed to connect to my network in in any way. Then we have umbrella duo, but what today what I want to do here is I want to focus on the modules which are related for threat detection and response. So there have been, there has been a lot of thinking.05:24Why we built our architecture in that way. One big thing is we thought about how we can bring detections to the customer beyond XTR. So we have done detection test a lot of detection tests, right? So we have been companies doing.05:42Our red teaming for us.06:02And then, but what about the network and other things? Okay, so what are the five modules here? EDR for everyone who is new here is this is our EDR, so secure endpoint is our EDR platform. It it is a solid EDR platform with endpoint engines.06:04We have, we are outlining detections on an endpoint, we have a strong API approach, we have a lot of integrations, right? But then we want to go to the next step with the XR architecture.06:242nd one is query and script, which is orbital. Orbital on forensics will be covered in detail in 2nd part today. Important for you to know is there have been questions like will forensics maybe replace orbital? No, it will not. These are.06:37Completely two separate tools with completely separated outcome. With, with Orbital, one example here I want to query.06:5750000 endpoints at once. I want to know if a specific process is running and so on. This is what we do with Orbital, we have a catalog, we have 500 plus templates in the catalog and so on. Script part means.07:05Everything so we installing or activating a virtual Python environment within orbital, and then you can use response actions. In 2nd part, I will show you how you can use playbook, workflows from XDR and then the query and the script feature in action and how you can use it.07:21Direct event working on an incident.07:41Network visibility, network visibility and the sector next from the endpoint visibility model are giving us telemetry. I don't want to spend too much time here on that overview slide, but even when we're going into the details, it will be super clear for you. Network visibility means.07:44We want to bring together the application layer on the endpoint and the network layer. Why we want to do that is if there is if there is a detection, we want to know everything, all network traffic from that endpoint maybe over the last month and so on.08:03Endpoint visibility. So the endpoint visibility model gives us insights into the activity directly on your operating system. Why we do this and what we have, what other thoughts behind this? I will check with the upcoming slides.08:21And even what is included or which telemetry we are generating for the endpoint visibility. Next one is the forensics two. What we want to do here is we want to automate forensic work, so we have hundreds of forensics categories there. We are.08:39Taking information from the endpoint and then analyzing that like your virtual incident responder. It also includes remote shell capabilities, full memory dump disk dump, and so on and so on, right? But even forensics will be super clear after 2nd session what it is doing and what the capability.08:58Okay, what we now have done is or what we now do is, and I think this is a slide we might have already seen, this is the five models and which are integrated into XDR and now we are adding all the other things and we talked about in the 1st part.09:18What we do here, right? So we bring on the one hand side flow logs from the network layer. We bring integrations like threat intelligence with Talos and other sources giving us information for observables we see on maybe on the endpoint, and then we have these integrations. There is, I will share the link afterwards.09:36Is we have a tons of integration, we have a very granular.09:56Description what the capabilities are for each integration. But this is the big picture here, now think about adding identity, adding email and other sources here and it's not just putting information. It is taking this information and using the XDR analytics engine to generate an incident.10:01And this is why we don't edit this all to EDR, right? Because we do much, much more in XDR. Okay, today I have four terms which are very important here. AI, it means how the new agentic AI looks like in XDR.10:17Number one, how we use AI in the externalytics engine. Then we have assets. So the asset inventory is super important for us because we want to know exactly which asset or computer is behind an incident. And then we have two main important things, terms, event interest and based.10:37The metric. So what it means.10:57If we are integrating an EDR and also say one EDR that can also be a non Cisco EDR and then we might have detections over time, maybe over a month. What we then want to have is information about what happened on the endpoint, and this gets more and more interesting if we have only one.10:59One detection, right? So what now with EVM and NVM doing, they are generating telemetry for us, and what happens on the network side and what happened on the endpoint maybe over the last 30 days, and then we know exactly what happened before and after that EDR detection.11:19Okay, so why we why why we say beyond EDR? What we have done is in the past we have done a lot of detection tests. And what we have used here are living off the land binaries, so what we have done is using trusted operating system executables to do.11:39Do malicious activity on the endpoint. If you want example here like I like notepad because you have NO idea you can use Notepad for so, so different, so many things. Like purple is EDR blue is network.11:59Process activities reading information from processes, steal browser infos. What we have done is using Chrome what is called developer tools to read the password from Chrome to read the co to read the cookies. DLL inject like ingesting code into running processes like notepad, and the notebook is.12:15Doing stuff you would never expect. Registry, like getting information about user accounts from the registry or what we have also done like how.12:35A payload can hide activity cleaning it up itself. So what you can do is you're adding the right registry keys and then the operating system when it boots up is removing that files. And this activity happens before all endpoint security software is running.12:45So this is one way how to hide activity. Change access token. Changing the access token for a user and granting more access rights on the endpoint. And then we have done a lot of things with the network like browse SMB shares with PowerShell.13:04Taking a look on all the SMB shares which are available copying the data locally, compressing it with PowerShell and then uploading it as an example to the C two server. Fake TLS is it looks like you are communicating as an example with an Amazon.13:22Server but in reality you are communicating to a completely different account. RDP is session hijacking, getting the view of the user directly on your screen. SSH session hijacking, really hijacking the session, then you can do all the SSH.13:40Comments from the established SSH connection and so on and so on. So then we have made it a little bit harder than say, what happens if we don't use TLS if you're using another protocol? And then we made it one step harder and say, ok, what happens if the C two server is used or is behind a trust.13:56The cloud service like dropbox, GitHub slakes or Discorp.14:16If you want example here, Notepad is downloading a picture file from Dropbox, which then includes the C two information for notepad, to execute something on the endpoint. If we, so, and now it comes to our architecture.14:19If we only have separated products, we would see isolated symptoms, right? But what we want to do is we want to generate a story and say, oh, what happened? What that notepad done and why notepad was communicating with Dropbox and what happened here and what was the activity?14:37Network visibility. So one tool is the network visibility tool. So we have secure client here and then we have our EDR, right? So we let's put here note here. So we have here our EDR system, right? So we have our network engine. We have our.14:56This bit firewall which generates logging, and then we're sending detections.15:14To XDR. That's not so so good. What we want to do is this, is we are bringing the network layer, the firewall layer and endpoint together and generating flow information and sending this to the XDR analytics engine. So at the end of the day, we know.15:19Know exactly which application.15:39Has done which communication the user behind and so on, and that's correlated with all the other things we you or we or you interesting into the XDR analytics engine, right? It also includes that you see the MAC address, the, the network car.15:42Starts.16:02The parent process a lot of information about the operating system. 2nd one is now the EVM module, the endpoint visibility module. So the endpoint visibility module is not available today. We are close to GA.16:03And it should be available soon with the new upcoming XDR version where we show.16:23The agent AI incident generation. So we have done a lot of updates in the backend, a completely new data store, completely new detection engines. There'll be a lot of cool things within XDR. And for this, we have now the endpoint visibility module.16:30Interesting part are the event classes. You see process activity, DNS activity registry activity, and memory activity as an example here, as an event class. So what it means in detail, number one is OCSF.16:50So within Cisco architecture, what we changed is that all our products are describing malicious activity in the same way. So that means EDR, network visibility, endpoint visibility, XDR and even Splunk are using this schema.17:08So it makes it much easier for us to exchange information between all the systems. I want to give you a few examples here, like memory activity. So every time a process is doing something in the memory like an allocate page or modifier page, this one's here.17:25We know this and sending it to XDR. If something is doing something with a Windows service, we know that in the XDR, a scheduled job, right? So you know scheduled job is the easiest way to let me say compromise a system because you can use the limit of the land binary, adding a scheduled job, and then.17:44Have infected your system and that you can stick it.18:04Registry registry key activity and value activity, like, oh, if I change something like my example before deleting a file during reboot or other things. DNS activity. Oh, we have seen that see two communication maybe to Slack or this, oh, this endpoint is.18:09Doing a DNS request. So we're tracking this and sending it to the analytics engine. The cool thing here is it really gets extremely hard to hide malicious activity completely on the endpoint, at least one of these things must be done by a payload.18:26To do the malicious activity.18:46So what is the outcome? I think it's you know it's a lot of content and I know it's very intensive session, but this should help you to understand the value. EVM, like EVM says, oh, I have seen that in memory attack is detected by my Cisco XDR analytics engine. We.18:48Yeah, so.19:08Based on this, we see, oh, this memory or this process has also done something on the disk. It changed the system and all the things we know from EVM, compared to the network visibility module, which gives us, oh, we have CNC two communication, but then we know what was the application, what was the proto.19:09The call which port has been used, how long the neta communication has done, how much.19:29Bits or bytes or megabyte or gigabyte has been transferred during this conversation, meaning or how long was the communication active, right? This is what we get with EVM and NVM, and now think about this correlating this with all the other telemetry.19:36Right? Coming back or closing this chapter is EDR, XDR is not EDR plus plus. EDR is our foundation plus all the other things I have shown you on the previous slides.19:53Right, so finally statement is XDR includes an EDR which is one of the five modules related for threat detection and response, and we are bringing together the EDR layer and the network layer from an endpoint perspective.20:07Okay, this is a very cool slide. I want to come back here to EDR once again. So, when we, when you are talking, when we talk about detection, this is extremely important to know if you're already using our EDR is.20:26You won't cover all the cool detections with EDR only. It is super important to think about XDR. And we have done a lot of design considerations for XDR. Number one is the following is what happens if the customer already has an EDR?20:44Or what happens if the customer using a multi vendor strategy or what happens if the customer has endpoints where you're not allowed to install an endpoint security product? What we can do, so all this flexibility lead into.21:04Hey, let's separate EBM and NVM and don't put it into EDR. Like I have a server, I I'm not allowed to install any security product, but hey Orbital is non intrusive EBM and NVM are non intrusive and forensic as well.21:22Giving this capabilities or I have a 3rd party EDR. I'm integrating a 3rd party EDR into our XDR, but what about query script? What about additional contextual information taking EVM and NVM, putting it on top of an existing EDR.21:38On your environment. This is how we designed the whole architecture. You see a lot of things and a lot of things are coming here. And once again here, this is the focus on endpoint, right? In some, what we do now, and you have seen this on my introduction slides.21:58More integrating 3rd party for base telemetry and event ingest. Event ingest, the cool thing is we recently added a feature where you can just generate a pushing incidents from every system. You just need the right specification and then you can just ingest nearly everything into the excel.22:16Okay, when we do a timeline, and this is what we want to do is, hey, we have seen there is an email coming victim one as an EDR has DHCP is opened, the email is downloading something, then we might get.22:38Observations from an EDR, then our NDR might be see, oh, we have seen an openc two channel. Then in the next step over the time is EDR is discovering comments what is typically happening on an attack, getting information about the endpoint. Then maybe.22:53The victim one changes the IP, changes my network within the company or is leaving the company gets a new IP. Then maybe EDR is generating an event like Active Directory find.23:13And so on. And then we see more observations like the victim one is communicating to my active directory server one using LDAP, maybe grabbing information and doing an SMB connect like accessing share. Then it does a SIG two communication, right? Uploading data.23:29And what we talked about is, hey, what is about if this is not aC2 server and classically C two server if you're using a trusted cloud service like the Dropbox and google drive. Then victim one is maybe doing lateral movement and using a remote desktop protocol.23:48Connecting to active Directory one with the credentials harvested and then active one active directory one server also maybe connects to the internet that maybe could be a completely different C two server and then.24:07Going to the next directory server and say, oh, a lateral movement or using SMP protocol, and then finally, from active directory one doing lateral movement to Active Directory one three, what we now have is three compromised active Directory servers, and then we might.24:23Let's see.24:42An EDR detection and say, oh, we have ransomware here which starts encrypting. What we want to do is we want to have the whole timeline. And this is where NVM and EVM helping us on the endpoint side generating telemetry. If we don't do this.24:43We have isolated systems, right?25:03So what we now do here is we're taking this and you see these two terms again here, eventing test and base telemetry. We are putting this into XDR and then we are generating what we call the XDR storyboard with agentic AI. Once again, I have a lot of screenshots here and it will be clear how it.25:06Looks like, and then we want to have defensive actions like.25:26Restrict access to something blocked by isolating, interrupt by updating the policy. Even everything is blocked, we want to generate additional detections, we want to observe activities, right? And we want to have options to clear and remediate our endpoint. And this is exactly what.25:30We do with secure client and the modules related for threat detection response.25:50Okay, transition from EDR to XDR. 1st of all this is really for existing EDR customers and showing you what is the difference. This is how the actual EDR platform looks like. So we have an inbox instance that tells us, oh, there is an endpoint.25:55And I have detected malicious activity on that endpoint and they are outlining that here, right? And then you are investigating that endpoint. So with XDR, we're going into this and this is already how the atlantic AI storyboard looks like.26:14Is we are using multiple AI agents and now taking all the information from all the events and from the base telemetry generating the attack story, like we have a name here, and then we have the confidence level, you know, if you're doing a detection it's not 100 %.26:32Clear ok.26:52Is it really a threat or do only see some suspicious behavior, right? So as there is a lot of information that generated this for you. This is how the storyboard is structured. We are generating the impact. So that means we describe the impact for your company based on what we have.26:54Detected on the endpoint side and on the network layer, all the other integrations. Then we are generating a summary and saying, ok, how was the reasoning done?27:13I'm adding evidence from network visibility and endpoint visibility to different understanding what happened, outlining the detections, and then the next important thing here is recommendations what I should do as an incident responder, and then we are generating dynamically.27:22Actions, so based on what we detect, XDR shows different actions you should do, and to react on the threat. And then we see this part. I think that's very important as AI can be wrong.27:42We are showing what we have analyzed. We are giving you the details what we have analyzed, giving you a timeline, and you can also review the roll logs and say based on this rollout we have generated this analysis and then we have generated these detections. Oh, and finally, sorry here.27:58We have the timeline, how we have analyzed all the things going through the whole incident. Okay, here we are. How evidence looks like? Let's start with EDR. So EDR says, oh, we have a code for data.exe.28:17And we know that's a malicious file. This has been executed. Both as EVM and NVM both are submitting application details we have seen, oh Chrome.28:33Called potatoe, we have, here is Chrome, sorry. Here is Chrome. We have used the remote debugging tool with Chrome to do malicious activity, right? There is at the end of the day, there is much, much more just a few examples.28:48The EVM module told us that you see shadow copy, right? So that means EVM is telling us that VSS admin.exe has been used to delete shadow copies. Then the network visibility module is telling us, oh, we have seen connection to my.29:04ONC share, which is SMB, and this is my domain controller. This is the port. And from my point of view, the most important thing you see both hosts use cold potatoe.exe, to connect to this IP on port 80 and using unencrypted HTTP traffic.29:24So at the end of the day, the idea is you don't need to go through tons of, tons of events, right? We are describing the information here for you.29:44What is really happening on the endpoint? Okay, next one. Detections. So we see once again what we have detected, we see once again the probability, what we have detected, you see it's a true positive, and this time for this singing.30:02Actually we have low confidence. While clicking on the details here, it gives you.30:21The details, of these detections. You see my information common and control, and the web service it was one way communication. We have our code data exe here once again, and this detection was.30:27This core based C two communication, right? From and the communication was done to this IP, and then you have all the details. This is just once again a summary, oh sorry.30:46If you want, you have now two options, number one is you view the chasing content of that detection and say, oh, let's go into the details how XDR has generated this detection sorry refume the raw logs or.31:03Going into the into the detection details if you click this one here. So how this looks like, once so how the or how this detection has been generated? We see the name here, it was a potential discourt comment. The source was our network.31:21Ability module.31:41The finding ID severity level is critical, then we are adding my information and say, oh, we have mitree tactics and my techniques based on this. And then we see the activity details you can dive once again deeper into the network activity clicking here.31:44But also already having a search option to search into the raw log.32:02Of this activity. So next one, analysis. How we have done the analysis of the data we received in XDR. You see we have a device here which is slate.32:09It's the computer name, and the important thing when you're going through the analysis and the timeline is this one here, every time you click here, you're getting the details here on the right. So you see we have some kind of overlap about information with evidence and analysis. We are.32:26Constantly working on this, so.32:46We will improve this so we are constantly improving this and but the outcome will be super cool. So what we have seen here is once again, the administrator, so we use this card in slack.32:49Both. We have my information, right? And we see exactly what happened. This is what I have done is to generating an incident, we have, I have used this payload and really used this cord and slack for C two communication, and then we have the device analysis description here.33:06You see it's AI generated, the whole slave was compromised via stage execution of cold potatoe.DXE. We have the here where it comes from, let me see a counter payload established multi channel commod and control via commod and slate and so you see instead of going through.33:25Events data or thousands of events, you're using this AI description to understand what's happened. And then finally you go here and say, oh, how we have done this analysis and say.33:45When we have seen this and what we have done and what we have detected, so you have a very, very clear understanding how we have done the analysis. Okay, next one.34:01I talked about we want to react, automated and manually to an incident. One thing here is workflows. Oh, sorry, coming back workflow. I will use this complex workflow.34:17In a demo, in 2nd part, this workflow comes from a community. So that means you can build your own workflows, but you can use a lot of workflows we already provide here in our exchange folder in the cloud.34:34To see what we want to do here is.34:54If there is an incident and there are users included in that incident, I want to automatically or just with one click, lock that user out from all my endpoints, which are, so you have two options. One is all my endpoints which.34:57Are included in the incident or all my endpoints.35:17So let's see the time here we are good or logging out the users everywhere in my environment. This is what you can do. So this is super simple. So in 2nd part we will talk about how to use a playbook and then adding a step to the playbook.35:21And behind that step, we have this workflow I'm showing here, so you don't need to build it, and then reacting on the incident. And in reality, this implementation you see here on the screen is done within 5 min.35:37Without any coding. That's really cool. Okay, how to deploy this? How to deploy secure client? It is super simple. It is, there is.35:53The client management, so if you open XCR, you go to client management and what we also have profiles, so I haven't added screenshots for the profile, a profile includes all the settings. So like I have a profile for VPN. I have a profile for our.36:09Test based security that includes the settings. Every profile can also be.36:29Changed in the UI, or adding additional settings or updating. You can export profiles from other Cisco security products and import them directly into XDR. And we have profiles which are predefined like for endpoint visibility and.36:35Network visibility module.36:54You don't need to, generate a profile. It's already predefined and then you just select it. Okay, so to build, to secure client deployment, it's super simple. It is a few steps and it guides you through generating the deployment.36:57Number one is giving you the name step one, you see I called it full coverage. That's it. Then you click next and then going to the next step and say the cloud management. The cloud management model has two important things.37:16Number one, it generates the unique ID. So if you reinstalling the endpoint, we want to have the same ID. If you want, if you're reinstalling the operating system as well, we want to have the same ID. So the cloud management module is able.37:32To detect, oh, that's the same hardware, that's the same endpoint and then generates the unique ID for us. Once again, why we need this? If there is a detection from the network layer, we want to know exactly which, which asset or device is behind the detection. And this is why we have the cloud.37:51This is one, this is one thing what the cloud management module is doing, and it provides automated update capabilities for all your Cisco secure client modules. For that you have multiple options here.38:11Number one is latest. So it means if you're selecting latest, you automatically get installed the latest version of that module, right? So for testing purposes or gold user groups, that's perfect. For.38:27Let me say, for the whole environment, I would select the recommended one. Recommended means we have, this is the version most of our customers are running on and where we don't know, know about issues.38:46Right, so for a production environment, I would highly recommend using the recommended version. So that's mandatory, so the cloud management is really mandatory for everything for a secure client and using the XDR analytics engine.39:05Next one, secure endpoint is that's a bootstrapper, like you select the EDR instance so you can connect multiple EDR organizations to X to one XCR tenant and then you select, oh, in this deployment, I want to use.39:21This EDR org, and I want to use the policy from that group.39:40And then this is part of our, of the deployment package. The next one is endpoint visibility. You see it's super simple. You just selected here, you activate it, and then it's part of your deployment. There is NO need for any profile because the EDR, the NVM e.39:45VVM module endpoint visibility module directly talks to XDR today, and therefore there is NO need to select the deployment.40:05So endpoint data loss prevention. This is part of our zero trust approach. I don't have too many in, I don't have insight what the model is really doing, out of scope for me today for threat detection and response.40:15But yes, go to my Cisco co workers like if they reach out experts on zero trust approach and explain you what we do with that module. Secure client. So this is coming a little bit from the past.40:31And it includes multiple settings or three things we should include. Number one, we need secure client because secure client gives us the driver base for as as an example, the network visibility module, so you need to install this, otherwise we don't have network.40:46Telemetry. The diagnostic and reporting tool dark, I highly recommend always using it or deploying it. If it comes to an issue, it is easier to detect or generate all the.41:06Diagnostic data and share it with tuck. And then Tuck has all the information to investigate your issue. And you see here, one important thing, secure client and then here is the network visibility module.41:24Right? So for the network visibility module from the history, you have two options. Number one here which is not highlighted is using an on prem system like secure network analytics. So what you know you have two options to analyze or you have multiple options to analyze the network visibility.41:39Traffic. Number one is using secure malware and secure network analytics on prem, and you use number one here and sending network visit data there or if you're using XDR, what makes totally sense here sending it directly there, we have a predefined.41:59Profile which is called NVM Cloud default profile you selected, done. Next one. Zero access route certificate, right? This is for HTTPS traffic when you're using our zero trust approach. By the way you see here on the left, oh.42:17Oh, come on, ok, it should be this line here. Everything which is blue is mean it's for threat detection and response. Zero trust access, right? Our new approach for VPN and how to access applications.42:34Orbital. In the past, Orbital was tied to our EDR product. This is what we already have now changed. So you can Orbital, you can now install Orbital as a standalone module. Coming back, you know, to my pre one off to my previous slides is.42:52I have a non Cisco EDR but I want to add query and response capabilities to my endpoint, and this is where I say, oh, here is orbital. If you are already building a deployment and says, oh, I have secure endpoint installed.43:07You see that conflict message. So why you can't, so if you're using our endpoint and Orbital at once, Orbital gets installed by our endpoint because we have integrations between our EDR and our Orbital like.43:23System snapshot, XDR and vulnerability management. So with the system snapshot is we have a detection and then you have an automated action in EDR which says, give me generate a system snapshot. So we have.43:42Firing a bunch of orbital queries and forming this into a, let me say the system state, like what processes are running and so on and then gives if you're going to the analysis tool in at in the EDR console, you see this information. Vulnerability management means we are querying information.43:59From the endpoint to giving you vulnerability information in EDR and therefore we need that tight integration between EDR and.44:19Right, but super simple if you're using our EDR, deploy it with our EDR just in the policy, it's one click enable orbital. If you have a system where you're using NO EDR or a 3rd party EDR, you need to use statistic deployment here.44:28Forensics. Once again here is super simple. We have a default profile you select and then once again the version profile using the select the latest version or the recommend recommended version. Last but not least is our digital experience monitoring.44:47Cool product but today out of scope for threat detection at this point. What we already see here is how much, how many different modules we already have for our secure client and I assume it we will add more and more modules over time.45:06Okay, if you are done, you click save, and then you see here, oh, your deployment has been saved. That's it. And the next step then is download. You have two options here, the full installer and the network installer. Full installers as it, as it is named. It inclu.45:23Includes all the sources, and then you have one exe file which then includes all the deployment sources. The network installer means you're just installing the cloud management module. It's a very it's much smaller in size, and then the cloud management model is installing all the software.45:44Okay, I think with that is summary for part one of today to get everything you have seen today.46:01You need two things like activating the cloud services, meaning adding your security cloud control account or activating your security cloud control account, going into X and activating XDR.46:16Right, so logging in what's not here logging in in every security console, none. Second one is what I have shown in the previous slides is configuring a secure client deployment package and deployed to your endpoint.46:33And then is the next steps then would be playbooks and workflows. How playbooks and workflows look like will be shown in part two, right? And then highly recommended going here and say ok connect.XDR security.cisco.com.46:49I'm taking a look which integrations we provide out of the box for XDR, what capabilities they provide, and all of them are super simple to all these listed products are super simple to integrate into our XDR architecture.47:09I think yes, I think a lot of value just a cloud service and one endpoint of one endpoint you are installing, right? With that, I think we are close to the 50 min, is that right? And that's right. Thank you, we will be going to a short break.47:2913 min, so we will be back at the top of the hour.47:48I will start timer and then we will be back for part two in 13 min from now. Great, are there any questions? I should answer? No, there are NO questions for now. We are good thought.47:52Great, great. I think we are really point on time, right? 2 min, great. We are. Yeah. Great. With that yeah thanks so much attending part one and now heads up, have a great break and see us in.48:11In a few minutes. Welcome back everyone. It's 11:00, so we will resume.48:262nd part of the webinar. Orsten, please go ahead. Great. Thanks a lot. So let's share my screen again. Just selecting the right one. So, can you see my screen?48:46Yes, we can see it. Great, thank you. Okay, so in 2nd part, let's go into how we, how you can respond to threats with the XCR platform, right? Let's start with this screen. You see once again the storyboard we have generated.49:04What you see here is on that screen as well, let's see my notes here, the timeline. So what I really like, and this is a big change to the actual.49:23Design showing incidents is you have the timeline, then you click on the timeline item and then it marks the right, areas in the relations graph. So in the past, you know, if there is a very noisy relation graph, you had to go.49:38Go through.49:58All the items there, so this makes it much, much easier. With the new UI, you see response, evidence, all these things are still here, right? Response, how you want to respond. This is the playbook and this is how we want to go through the incident as well.50:00The design is the design.50:20Once again here is work that you do all the incident or the respond work with XDR, so you don't need to go into other consoles, right? Step two is if you need evidence for your.50:23Incident and you need to know much more about the endpoint. You want you need a full memory dump or a disk image or tons of evidence. You're doing this with extra forensics. If you want to query your whole environment at once with orbital and at the end of.50:43After day.51:02There is nearly NO need anymore going into the secure endpoint console. You can do this as well, but as we described the incident in XDR with a gentic AI, it gives you much more information here.51:04Okay, so what we typically do, if we outline an incident in XDR, it is important to activate isolation on the endpoints. So isolate endpoint. So if we do this and you there are three options to trigger the an isolation.51:24Number one is activating an automated action in the EDR product.51:43Number two is having an automation workflow within XDR. Number three is if you already have an architecture and security architecture implemented in your environment using the API and then start the isolation.51:49On the endpoint. So what that means is we are disconnecting the endpoint from the network using an own network driver. What in the isolation status, we immediately stop the threat because there is NO communication possible except the communication to the Cisco cloud.52:07Right? So this when we now have isolated the endpoint, this gives us time because what we now happens is continuous monitoring continuous telemetry from EVM, NVM.52:26And EDR, meaning so that the change even in XDR is that you're also constantly updating the incident based on incoming telemetry. This can also lead into a result into change of the name of the incident, but we are.52:42Constantly, so XDR is constantly working on that incident.53:02That's really cool. So if this is done, you have now two options. Number one, once again, XDR forensics and orbital. And this is where we want to go now a little bit deeper during this session. Okay.53:06Summarizing how you can respond once again, if there is a threat, isolate with EDR doing remediation steps with orbital, doing a remote shell and automated forensics with extra forensics and the analytics engine gives us the incident storyboard.53:23Using AI to generate incident and the automation options we provide with the in the XDR architecture.53:43Okay, two tools, two outcomes. To very, to be very specific here. Orbital has two parts. Query information respond to scripts. Once again query information means we are obstructing the operating system into high performance databases, meaning.53:52You can query the endpoints or the whole infrastructure using simple SQL statements, so that means you're querying the endpoint like a database. Give you one example here select star from processes, gives you all the running processes from the from the endpoint or endpoints.54:10If you want to know what areas, so we have hundreds of areas you can query this orbital. If you're going or navigating to always query.io, gives you all the options you have, you can query this orbital.54:30Second one is response with scripts like I have this after activating orbital scripts, we are implementing an independent virtual Python environment, meaning in addition to the older catalog.54:45Entries we already provide, you can use everything you can code with Python and then enforce it as a response action on all your endpoints with Orbital directly or you can also do that with the API. You can store everything you can store.55:03Or you can generate new catalog entries and then executing them. But what you can also do is encoding your script and then directly executing your, your Python script with one API called.55:21On all your endpoints. So it's super fast, super simple, and super lightweight. An orbital query typically does a few seconds on the endpoint and generates NO load, right? Okay, forensics, so the the.55:39The Forensics works completely different. If there is a incident in XDR and then you say oh I need evidence for this XDR incident, we are generating a case in XDR forensics.55:56Based on this, part of this in part of this case, we have the data storage and then you start to acquire data from your endpoint. This can be millions of evidence. We so we store this.56:12And then we have specific analyzers to process this data and doing a deep analysis of all this data. And you see it's a completely different approach and this is why both tools compliment each other.56:29Right, so once again here, so your incident responder right through animation here, you're doing a query, you're doing a script, you're getting the result, we store the result, that's it as if there is NO query or NO response action running at the time.56:46Everything is more or less or orbital consumes NO resources on the endpoint, right? So compared to the procedure with XDR forensics, so what you should do working with forensics is you should think about.57:02To see the trusted evidence repository, meaning.57:22If there is file exchange with the endpoint or you're generating images, this image of memory full memory dump, where you want to store this information. This can be an SMB drive, this can be amazon S3 bucket and Asia blob, and the most important thing with this.57:26Missing here is.57:46Let me type it here is block. I really missed it. Sorry, right? To store everything. And then the main tool for you as an incident responder is the investigation hub. The investigation hub gives you the.57:47View and all the data.58:08Within the forensics case. Just to ensure the terminology here within the product. And then you see the ball recycling depending now how deep and how much work you have. Number one.58:10The case can include multiple assets, number one. Drone analyzers here. Drone analyzers, we have 600 plus I think already more than 700 plus forensically sound data types. It means everything we find we classify for you. No worries in in the next.58:30Slides. I will also show you a lot of screenshots, right? This is what I call a little bit like a virtual incident responder who takes a look into the files, what is going on taking a look into the registry and all different areas of your system and is already analyzing that for you and giving you a.58:49Oh, I have seen this.59:08This is what we call with automated for it. Come on, so remote job. So what I like with the product is you have, you can have multiple screens like I have the main screen here, I have the default screen.59:10In here on the right and then during my incident responder work, I have.59:30Established a remote shell to one or multiple endpoints at once. So forensics is really a tool where you work with the endpoint doing very, very deep forensics work on your endpoint. If you have.59:36Definitions based on OS query. You can use this and executing a triage task and say, with one example here with OS query I want to collect information.59:52From an endpoint which is not default part of my acquisition profile. So what then happens is that forensics is executing this, your OS query statements, taking this information, storing it in the forensics case, and then my drone analyzer.01:00:08Analyzing the result for you.01:00:29Now this is typically how you work with the product from a high level perspective, right? So how this looks like in the UI, so we have this incident, you see here, we have multiple C two channels high checking VSS. This is the same example we already have done, and then.01:00:31You have two options. Keep it simple. Acquire forensics evidence or directly start a remote shell from the XDR incident. You see here is the top evidence, right? So that this is work is you need, you see here the secure client.01:00:51Deployment, what we have done in the 1st part, we need secure client installed and we need the extra forensics endpoint installed. If you click acquire evidence, it is super simple. Give it a name.01:01:11This is how it looks like in the UI, and then we have the data collection template. The data collection template includes the data you want to query. That can be the whole Windows event log.01:01:28That can be a DNS log from a server, that can be all files from the disk, that can be the whole registry, that can be, oh, search the Windows event log only for specific event IDs. So there are tons of things you can.01:01:45Collect here, but you can also generate a collection that says, oh, I've collect everything which is possible. The only thing what they don't need is a full memory dump. You can do this and this is what I have done in my example, but then keep in mind, you have a lot of.01:02:05Information in the UI, so now second one is this one here is highly recommended, so that means what forensics is doing, it takes a look under on the acquisition data, analyzes it, and then also maps it to the metro framework.01:02:24Okay, assets. Depending on your incident, there can be one or multiple assets you want to acquire forensic evidence. If this is an endpoint you might collect everything and then you do a second acquisition task and say only for my server, I will.01:02:43To see the DNS log. The result is this. So this is how the XDR forensics looks like. It is super noisy, but it's super cool for anyone who is doing forensics work. Everything what you see here now.01:03:02I have nothing done as an incident responder. Everything here has been generated fully automated. So there are some principles within XDR forensics, these are super important.01:03:21Number one, you can generate multiple acquisi You can do multiple acquisition tasks and multiple triage tasks with different settings applied to different hosts within one case. Why we do this?01:03:38If you work with XDR forensics and you're filtering something and you're searching for something, every action gives you a full unique view on your whole data within the database.01:03:54So let's start this one. I want to view everything. You see here I have five assets in this incident. The acquisition data, the evidence has been the the evidence generated by acquisition passed has been classified in the 115 categories and I need I have.01:04:0914 7 million pieces of evidence, let me say that way in in forensics. It has been automatically mapped to my trip, so we have a lot of techniques and a lot of techniques. I have done a lot of malicious activity here just to fill the dashboard. So typically it's not too much, right?01:04:29But just to to show you the outcome. All right. Findings. You see, high, medium, low severity. If you see that the color, you see the endpoints here, you see flags.01:04:48And then you see the global filters. So that means every time your filtering here also changes the evidence explorer. So the middle, in the middle of the screen you see the details and then you can also go into this one and say, oh, in this case I searched for notepaddled LNK and you see here.01:05:04It is part of that evidence category. What you see and this is where we really go very, very deep. So we see here as an example browser downloads. So in addition to this dashboard, the acquisition task included all browser downloads.01:05:24There has been 24 entries or evidence we have seen and 24 times it looks like it was a high risk. This is how some principles how the product works.01:05:44Number two is, you see here on the left, if you go to the findings page, it gives you the heat map. What you can do is now, and I talked about, I want to have a unique view on my data.01:06:00In this example, you see resource development, obtained capabilities, and we see three times we have evidence here. If I click it, it gives me the results.01:06:15Three times and then we have the details. So I selected it here and then it gives me the details, right? And you see in this example here we have a ramp.XLS. This is part of my of the remote access rogen I have executed.01:06:33Downloads an XLS file because the XLS file includes information how to communicate with the C two server, right? But what is telling us is that XDI forensics is not just collecting information. It also gives it takes a look and.01:06:52Into files and analyzes the files and gives you an idea of what's going on here. So the next one, actions. As I told you, I want to work with the data. Think about you have millions of evidence is I can select something here, right? This one.01:07:10Come back and say, what I now can do is mark it as a finding and say, oh, I'm absolutely sure this is a piece of software, what happened, sorry. Sometimes my mouse is a little bit freaky. And then it is a finding. So or you can also add.01:07:30A flag and say, let me flag this. It might be something interesting and I want to investigate maybe later on with the team because extra forensics also allows that multiple people are working.01:07:49On the same case at the same time. So, so I want to find everything again, right? So you have a field and say, oh, show me all the evidence within the database with a specific tag, right? Then you can also add notes, you can add comments, right? And so it's how you go.01:08:06Go deeper and deeper into the content, and getting more and more visibility into the threat.01:08:26So super important is the global search, and this is I think it shows the power very well the power of forensics is notepad, I searched for notepad.lnk.01:08:33What then happens is, as it is a link file and you only have windows, it just likes oh we only have windows. There's an internal capability. What it then does is already in the search and says, oh, what evidence categories.01:08:52I have seen the term notepad.lnk. And you see right here on the left AM page collecting for custom content. Custom content is, comes from OS query. I have said.01:09:08I used the query which says from Orbital I copied a query from orbital catalog directly into my XDR forensics and say, I want to know everything which automatically starting up on my endpoint. And then this.01:09:24Always query result is stored in the database extra forensics analyze it for me and generated outcome for me and this is custom content. You'll see 5th custom content here, 15 results. Device event and event records, this is something different like I have collected something and I also.01:09:41We have rated something, we have hashes, jump lists pass data, link collected files, my tree, prefetch, prefetch of our startup folder.01:10:00And custom detections. Oh, custom detections. Oh custom detections is here. Great. Startup folder, that means I have a link file somewhere and says, oh, there is a link between that file name, notepad.LNK and it looks like it is something in the startup folder.01:10:11So just searching for this term already gives you a very.01:10:31Clear understanding in which areas of the pro of the endpoint. We have found this term, right? As one example here is I selected this entry, so I searched for LNK. I clicked LNK collected files.01:10:35And then it gives me this one and the 1st entry I marked and then I have the details here on the right and say, oh, the link path is the startup folder of the administrator in it in his profile and the file name is notepad.lnk. But it's more interesting is that notepad.01:10:55Had.01:11:15It is named notepad.LNK, but in the end it starts power shopping, right? So yes, if you want to see now more details and this is what I really like and this is how I typically work with extra forensics.01:11:17You're in a separated window. That means you you're working here on the left, you're selecting a row, and then you can show the details always in a separated window. So what I really like here as an incident responder is there is a lot of data in the screen and that extra forensic is using high density.01:11:36In the UI. So when clicking view in a separated window.01:11:56It looks like this. And then it's very clear and says, oh, we have a LNK file, which is starting PowerShell and the comment line within the, the link file is.01:12:01Let's see Windows temp, onedrive.VBS, and now think about reality like how much work as an incident responder you need to do if there are tons of files within a user profile, and this is what we talk about automate.01:12:17Forensics and speeding up and simplifying forensics. There is a file in the profile.01:12:37Forensics takes a look into the file, what is really included, what is really happening, and then already doing a incident, a digital forensic work for you and outlining this as a result. Okay.01:12:42So what are now the next steps? Once again the use case here, I haven't, this is the dashboard and I haven't as a user, I have done nothing. And then I say, ok, what are the next steps? Acquire evidence.01:12:59Already explained I want to have more evidence or specific evidence. We also support multiple endpoint security solutions and what we also do here is we can analyze the log file.01:13:15Of multiple endpoint security solutions. So what you can do now and say, oh, let me verify, let me search or let me store acquire let me acquire to defender log. Maybe there is something still active, like, oh, what I have a non Cisco.01:13:32PDR and say, acquire the log files and let's analyze it with extra forensics, take a look if you find anything there.01:13:52Or I have a database server and say, give me the SQL logs and let me analyze the SQL logs, maybe there is something interesting or you have seen that onedrive.VBS and say, generate acquisition for all my endpoints.01:13:58Including the term onedrive.VPS. This is what you can do. And then you take a look only on that task and then forensic gives you the acquisition only for that task. So once again gives you a very detailed view on your forensics data. Acquire image as it is, give me a full disk image.01:14:14Hunt using rules. Full text search is new. I haven't seen it so far, or I haven't tested it so far, I need to need to figure out what it is. Interact means remote shell.01:14:35Compare what you also can do is baselining and then compare different tasks with the baseline or using an auto, assigning an auto tag task it means, oh, based on specific attributes at a tag like oh this is a web server, so helping you to classify your.01:14:52For endpoint in forensics, and then if you know everything you have done then and then navigating back to XDR, and I'm going ahead with the incident. You see super powerful. Okay.01:15:12But what about Worbidel? Question, are there any Henry, are there any questions so far about XDR? Because there are a lot of details I have shown in the last minutes. No question. I think you're doing such a great job tossing that everything is crystal great.01:15:29Okay, great. You know, it is it is a lot of content and I really I really thought about doing might overhelm you with all that information but once again, we will share this and then you can go through all the things and all the screenshots after the session and.01:15:49A re rethinking the whole session again. What you can do is, oh, what I forgot to mention here is what happens if an endpoint is not connected to your network or you have disconnected it from the network?01:16:07So, we are working or an upcoming feature will be that you do an offline acquisition. That means you have a small executable, you put it maybe on a USB stick, then you're going to a possible infected system which you have removed already from the network because it has been complica.01:16:24And then you're doing the acquisition.01:16:44On this system, and then you're taking the data from the USB stick and load it into extra forensics and then extra forensics, I will analyze it. Linux yes coming soon. The limitation here is not forensics because forensics.01:16:48Supports Windows Linux and Mac OS, but we need to wait for the cloud management.01:17:07Module for secure client and this will be released soon. Hopefully this answers the question. I have seen the pop up. Okay, how about the is.01:17:13Or how orbital complements here extra forensics. And what I want to show you Orbital in this example, like taking let me take a look on the time. Oh, we are good on time here is oh going back.01:17:31So we are taking a playbook. So what is a playbook in XDR? The playbook is our guided response. So that means the playbook includes steps and behind every step, we have actions. So the idea is if there is an incident.01:17:46You go through every step.01:18:06And then if you are going through all the steps, it can include a workflow. Or it generates it gives you one example here that one step can be give me a notification in my messaging service like Webex, and then let's confirm.01:18:08From something and so on. So everything think about as an, in your architecture, how you want to go through an incident. You can define.01:18:28Multiple playbooks, right? And then you have also AI describing what you have done. You have, you can add notes and then finally you get a report for everything you have done with the incident, what the Dan can.01:18:38Directly export from XDR and say, oh, this is what I have done in XDR. The same you can do with forensics and say everything, all the forensics work I have done finally, generate a report. So you have everything very, very granular because in, I forgot to mention that in forens.01:18:55We track every activity. So that means.01:19:15If you need traceability for the incident responder work, we track it and then you can generate a report and you exactly know how you responded to an incident. So.01:19:19Okay, let's stop this. Workflow and playbook. Let's go here and say stop and let's move over to my Chrome browser. So, can you see my Chrome browser? Yes, we can see it. Great perfect. So.01:19:35This is a demo you can also use and this the link is on the next slide. So if the screen resolution doesn't perfectly work for you, you can redo this at any time because when i'm changing and last time when I changed the resolution, it just.01:19:52Messed up the demo.01:20:12Okay, so you see what we want to do is and this is exactly how it works in reality. This is if you are using XDR today, this is how you can update the playbook and leverage an XDR workflow to automate incident responder work.01:20:14So you click on automate and then you click on exchange. So exchange means workflow exchange. Ah, I can't use marking, ok? So what we provide is we provide workflows. There can be workflows which are.01:20:33Built by Cisco, but you also have community workflows, right? What you then do is you go to explore and then you say oh search and if you search for user, you see Cisco Orbital incident response force user logoff, right? So if you click it.01:20:54You get the details and you say, oh, it has a five star rating and this is super cool. It gives you a description what is done, it has been generated by its a co mate from France and he's also doing a lot of sock.01:21:12Things within Cisco, he's really a super cool guy and he has generated that workflow for you, we have seen on on part one today it is super complex workflow, right? What it here shows on the right is you see it is type, it's an orbital workflow.01:21:28And blah blah blah yeah the description and everything is fine and then you just click install. You click install, then it says, oh, confirmation, do you really want this is like everywhere in the software. Do you really want to do this? And then.01:21:47Click continue. So what now happened is in the background XDR is downloading the workflow and has installed it. So, go to administration and now we want to update the playbook and say, ok, here's my playbook, you see and we have three things playbooks, the list of playbooks, we.01:22:04Have the tasks mean I have a summary of tasks and every task I can use in all of my playbooks.01:22:24I click task and you see these are, this is the list of all available tasks within XDR for my playbooks, and then I just create a new one. Number one is you give it a name lock off compromised user. You see a summary, you see a detailed description.01:22:33Add what you like here, right? And then you click add task, and then it gives you the workflow name and say, ok, when I'm using this task, which workflow I want to use and say, oh, I want to use the workflow incident response force user logoff.01:22:50Click next and then add the task. So what we now have is we have a new task and in the next step, what we now do is we are adding this task.01:23:09As a new step within my playbook and say, ok, you see I have an owned playbook for me. You see we have the Cisco, the Cisco one which is default and there is an easy POV Corp playbook. I click it. And if you never have seen.01:23:24If you never have seen a playbook, you see, we have the phases, identification, containment eradication and recovery, and every phase includes different steps like review incident, and this is exactly how you walk through, if you go through the incident, it looks exactly the same and say, oh, I have an incident.01:23:40Okay, let's go to identification. Let's go to review incident. It gives you information what you should should do in during this step, and then if you have done everything and saying oh yes, with identification I'm done, you say.01:24:00I have finalized this step and then you go to the next. This is how the playbook guides you through your incident responder work. And what we do now we're adding a new step to containment and say edit playbook, you're moving here to containment.01:24:14And say adding a new task, you see it's super simple. We have the task added previously log off compromised user selected this one and then you say add task to the playbook. Done, and then you need to.01:24:33Publish the playbook confirmation message and say publish, done. So important to know if you are changing your playbook and or updating a playbook, it does not change existing incident. That means if XDR is generating an incident, we are assigning.01:24:51The default playbook, so after your change you need to wait for the next incident, and then we assigning the new incident. This is what I have done here and say ok you click the incident, we have all these details. Let me take a time check or we are good on time.01:25:10Yeah, very good on time here because we also wanted to have some time for for discussions about XDR forensics and orbital. So we have this incident, this is the old one, right? It's not the the agent AI. I had not NO time to change it.01:25:28You click the incident view, and then you see response and response is reflecting your playbook. So I have done already identification. No, I haven't done your C.01:25:44Nothing is here, so typically here on the right you see what you already have done. I click on containment, I click on lock off compromised users. This is the task I have added, click execute. And then what happens is based on our incident, it lists one or multiple.01:26:00Users, from the incident here in that list, you click it, and click execute and say oh yes, workflow execution successfully started.01:26:20Let's close that one. And as we have the, so you see here required, this happens if the workflow is built in a way that you have options you can choose how XDR forensics are how XDR should.01:26:36React. So you click few and say my choice and say ok what you You have two options here and once again, these are defined in the in the workflow and say oh.01:26:56I want to log off the administrator from all endpoints which are in part of the incident or nothing about the following, you have 50000 endpoints and say, I want to log off that user everywhere in my environment.01:27:12With a single click, then you should select this one, all endpoints, right? So in this example, it is only my endpoints and then you click submit. So what now happens is that the workflow we imported from the community page is executed in the background.01:27:29Right, and it's running, and then you see, oh, looks good, everything is complete. And this is then how it looks like and say, oh, ok, going through this one here you see automation workflow.01:27:49Response task lock off compromised user, it has been started by myself. And then it gives you exactly the information where you have lock off the user. In this case I have locked off the user from two computers.01:28:04Which are marvel and sled. These are just two computers in in in my D cloud lab. I think I have done it here multiple times. See if there is anything else, NO. Okay, next step then as an incident responder, you're adding a note.01:28:22You see administrator has been locked off from all systems involved in the incident and then once again working this is a I think a very good example how to work with the, with the playbook and say number one is I just add a note.01:28:39And then I don't change the state of this step. Maybe I want to run it again and say, No, I want to add a note and say, change the status to complete or not applicable as you like depending how you build your workflows and how you build your playbook.01:28:53And then go to next, and then you see, ok, you see we're tracking everything and this is what I talked about if you are generating the report at the end. It exactly gives you about summary what you have done.01:29:09During your incident responder work, and then you see the information is here, cool. So how this looks like in the orbital UI. So if you are completely new and you have never seen the Orbital UI.01:29:25Here on the left, investigate means you can directly starting an investigation. Oh, let's finalize that 1st. Sorry, I don't want to confuse you. Let's control B, control P now not printing, sorry, control.01:29:43Yeah.01:30:03So under results, we have seen what we have done here. We have seen two things, where is the best one here 1st lockout? Yes. So you see this is a query, this is a custom query what has been executed 1st. That means there has been what you can do with.01:30:04You can stack queries.01:30:24And say I do a query and then I got the response, and based on that response, I am executing the next query. You see I have done it here multiple times, but what happens is the workflow 1st use the orbital API to say, give me all endpoints where the user administrator.01:30:25Is locked in.01:30:45This is the 1st result and then doing a second one and say, oh, for each computer, where we have seen, you'll see devices one here on the right, for every computer where we have seen the user administrator, do a log off completed, completed, number one, number one.01:30:47One, right? And then, I think I'm not 100 % sure but I think is there is a check afterwards if the action was successful and say, has the user really been.01:31:07Locked off from the user, from the computer, sorry. So, if you're, how much time we have? I don't think we have so do we have a few minutes? Yeah.01:31:20Sorry, how much? In 15 min. Oh perfect perfect. Then I can if you're completely new you can use this demo at home orbital query, it is super simple. Just give you an idea how simple it is. It is once again.01:31:36We will move this into XDR, so today it's a separated UI, but we want to have everything in XDR. It is, you, you get a device here and say device it means what you want to query host colon victim two means I just select.01:31:52What I want to query and say this is one host. What you also can say, I want to query a network or I want to query a specific operating system, say OS colon Mac oS or OS colon Linux. I want to query all endpoints having a specific operating system.01:32:11Then you select, what the query from the catalog or use generating a custom SQL statement that you can do a lot of cool freaky things with oil and then you click run query and then it gives you the result and says, oh, this.01:32:29There are the processes which are running on my endpoint. It is super simple.01:32:49But you see already from the UI it's completely different to XDR forensics. Just giving you an idea how Orbital works. It is the same for scripts. I think orbital scripts Yes, you see we go to the catalog, we have tons of catalog selecting a script.01:32:54Terminate the process by process ID victim two. This is the process ID. I click next and you see, Oh yes cool. Process has been terminated on an endpoint, right? And then we have a lot of cool things like advanced custom script but.01:33:15In interest of time, I can't go through this one. I give you one cooler example for Orbital as the last example. Think about the following. You have a SHA 02:56, and you want to know number one, is this SHA running.01:33:31As a process on all of my endpoints, number one. Or number two, is this process loaded by any active process that is running with in the memory?01:33:47Yes, this is what you can do with orbital. And then you can take the same name of the file and say with extra forensics, now query everything on that endpoint and say if you find anything with that term. Okay, you see cool thing.01:34:02So let's go back to PowerPoint. Okay, finalizing this, you have seen this, it takes 10 min. This is exactly when you integrate Orbital in the play in the workflow I have shown, it is in the same time than what I have done or shown here in the product and in the demo.01:34:20Sorry. Okay, these are the links and we will share it. So we have a demo for orbital. I have shown here and we have a similar demo for extra forensics, where you can go once again deeper into both products than we have shown today. In interest of time.01:34:40We can't go too deep into that pro, too fantastic products.01:35:00To summarize that is everything you have seen today, part one and part two is activate XDR, configure secure client and install it.01:35:05And I think the statement Cisco XDR is not EDR plus plus is fully true, right? We have our architecture, we have the flexibility in XDR using multiple vendors, using multiple EDRs at once with the contextual and knowledge.01:35:20Modules with EVM and NVM, having response.01:35:41Automation within XDR and having endpoint modules Orbital for query and response and XDR forensics which automates and simplifies your forensic work, right? Yes, that's it, I think.01:35:45That's a very, very cool architecture and a very cool product. There's a question, is there, what is the question? Is there a method that you tend to recommend to rolling this out to endpoints? My.01:36:02It's it's it's always like, I have done when I've worked in a 6000 views environment is the minimum what I would all always install is the cloud management module because and then it because then you're just connected to XDR and we already.01:36:21Have asset information.01:36:42And then it depends on your company if you have a phased rollout or if you are just rolling out. But from a system admin perspective, yes, always testing. With Orbital, as Orbital is a non intrusive one, I have never heard about any.01:36:45Problems is orbital installation. I think what I have seen 1603 the standard installation error, but this is what happening commonly on a Windows system with every piece of software.01:37:03That's it. So secure client is really super super simple to install that don't know about any real problems with that. Does this ask answer your question, Nicholas? Okay, great.01:37:19Yes, I know so. I think with that, we are Yes, we are at the end for my presentation with any other questions? So we have a few minutes left, so you ask and everything you think about.01:37:36Let's wait a little bit if some questions coming in. So let's stop the presentation here. Yeah, I know it was a lot of content. Henry, please confirm we will share the the presentation as a PDF, right?01:37:59Yes, absolutely. Yeah, we'll share the recording for both the for both days including PDF. So while we, on this part here, guys, we thank you very much for joining us. We really would like your feedback on the session. What do you think.01:38:16Sort of the content, is it too much? Is it too little, the length of the con the session, you know? So basically we, we put this together, you know, to share information that we know with you guys. So yeah, let us know what you think. Even if you didn't like it, tell us why you didn't like it.01:38:36So we can make it better for you guys. Right. Okay, there are NO additional questions. Thank you Toston and Henry. So that wraps up our two days on Cisco XDR. So a big thank you Tosten for your time and insights and thank you all for joining and being so engaged.01:38:51As Henry just mentioned it before you go, please take a moment to complete the survey. It will pop up once you close the session.01:39:12And we really value your your feedback because it helps us to shape our future sessions. Thanks again and enjoy the rest of your day.01:39:20