Final convergence and deprecation of Secure Cloud Analytics into XDR

Hello everyone and welcome to today's webinar. My name is Peter Henry and I'll be your moderator for this session.00:10I'm pleased to introduce today's speaker Logan Buttonrock. Before I hand over the mic, I have a few housekeeping items to cover. Today's webinar will be recorded and made available on demand after the live session. We'll provide you with some details at the end. Also, we'd love to hear from you during today's presentations. If you have a question for our speaker, please feel free to send it through the.00:17Question and answer panel where our wonderful panelists are ready to respond. So without any further ado, I'd like to kick things off by welcoming Logan over to you.00:37All right, thanks Peter, and thank you all for joining us today. We're very excited to provide some updates on our overall plan to migrate the cloud analytics, evolve it, and bring it into the XDR user experience.00:47So we're gonna cover kind of just a quick recap today of how some of the high level mappings are, are occurring across the experiences, the functions. We're gonna talk through a live demo of what's there today to give you a quick update on what it's gonna look like and.01:03Sort of see how things are gonna continue to evolve, and then we'll share some reminders with you towards the end. So just kicking off, really the the big thing to take away from today, if you haven't seen any of our emails or previous sessions is we've been on this journey to take secure cloud analytics.01:21And evolve it as well as move it into the XDR experience. So we have, you know, kind of a analytics function from the security cloud analytics.01:41Bringing it into a very broader security platform. That's been our whole move and with this, the timelines, you know, we've we've, we've we've announced this quite a long time ago with our end of sales, but we're finally really getting to move quite a bit very quickly here. So our timelines are 24 October 226th.01:50As our target end date.02:10Where this evolution and migration is going to be complete. And that really boils down to the actual user experience going away and XDR being the single kind of platform UX where you can achieve the same outcomes as well as, you know, whatever else XDR propos.02:12We do have a few customers in this, in this camp who have, you know, not even activated XDR yet. Most of our customers, you know, on the call who probably are also using XDR at this point, so this will be more of an update call for you today, but we just wanted to kind of remind everyone originally our, our target date.02:35Was 31 August, so for customers who had not yet activated XDR that they're entitled to as part of the end of sale, they, the 31 August date was our target date and why this was a target is because we're actually, you'll see it in today we're starting to migrate data.02:52Into the XR product from SCA. So there's data coming in from network traffic, cloud, et cetera. We've this program actually closed 30 September and this is really, really important because once the program closes, if you don't have XDR, there is NO, there is NO more SCA.03:08And come 24 October once everything's fully kind of wound down, there will be NO other place to experience and interact and configure, manage, monitor these particular detections and analytics you're getting from secure cloud analytics. So just to kind of recap it with a few slides of situationally, what is this migration high level?03:26We'll have everything sort of map over and.03:46What does this mean for you? The user experience will be an XDR as we've just discussed with the retiring 24 October, that will be the daily place for user experience. The telemetry, so the things we actually collect into make the magic happen, the analytics and detections happen.03:49That all remains the same. We're still collecting NetFlow, we're collecting cloud logs, ICE data, ETA, all the things that we would, and NVM, of course, that we normally would create detections on, that all remains the same. So for our customers, if you configured, you know, your network to collect through an MNA or a CTB or a cloud.04:08API.04:30You don't need to go and actually do anything there. We're gonna keep collecting that same data and we're just gonna be processing it in XDR a little bit differently with some more modern engines we've built detection engines as well as user experience, of course, and configuration for that will change into XDR. So the actual core of what we do with the product remains the same. It's a new experience and a new location.04:31That changes. But lastly, the workflows around the product, so if you built workflows around like let's say you export, you export data to a storage location, a sim, or you get notified via email. These are the things that, you know, we can't really.04:51Update for you, because we don't necessarily know your process and what you do with the data. So within XDR we've got a substantial amount of capability here through XDR automate, which is, you know, way more flexible than an SDA webhook, which essentially allows us to take the APIs from XDR, which I'll get to in a little bit later about how those things are changing.05:10And export the data you might need, send notifications to whoever you might need to whoever you might need using all of this automation platform that's built into XDR.05:30So that would be one action item for customers to be aware of besides activating next year if you haven't. It's making sure if you do have process heads around the product, getting it out of the product in particular to follow the guides and and the and get that set up in XDR as soon as possible if you have not yet.05:38As of earlier, is in its core mission is not going away. It's just getting stitch in as a broader capability set as part of a broader platform. So this gives you a good visual of what that looks like. We have security cloud analytics today that does, you know, the detection itself through alerts and observations.05:57We have the event viewer and device inventory that gets built from the raw data.06:16That we're ingesting, we have the web hooks and tuning and configuration around that data to get data out, configure how what you want to see, and then of course the actual sources of data coming into the product. This sort of gets mapped over to XDR a little bit differently, and I'll cover what that terminology mapping is, but it really exists as a capability set.06:21Within XDR, and you can see on the right, we have the purple highlighting analytics.06:41About what's really retained there. It's just not gonna be an isolated user experience and another thing you have to go manage and deploy, it's gonna be a part of the actual product and more natively sticks into it when this migration is all complete. Next year of course offers much more around.06:46And I won't cover all those things today because there's a lot to demo there. I can spend the entire hour just covering XDR, but there's quite a bit more around what XDA offers to take advantage of. In particular, the incident analysis, the AI analysis within that.07:05And especially the response and workflow automation as well as 3rd party integration being, you know, much more robust and not even in FCA historically. So really bringing up the the platform capabilities to bear for operating around that data.07:20One thing I've mentioned in previous webinars as well as a lot of the content we've published is the terminology we use and some of the actual engine itself, like the detection engines themselves are changing significantly. So while we're looking at.07:40The same traffic and same data as input. The actual way we analyze is, is changing. And we're doing this not because we just want to change for the sake of change, but really we've taken feedback from a lot of our prior years operating on top of this data from our customers.07:56From our field teams and really just trying to modernize our overall analytics capability so that it's more ro more robust, higher efficacy, and we've used to set an opportunity to kind of rethink things. So it's not just a UX migration and remapping of data, but it's really a whole transformation of the analytics capability. What this will look like to you is a cut.08:14Customer is you'll see the same data we have floating into the product, through the sensors, through the cloud integrations, but starts changing once we actually transform that data. So today we actually take the raw data on the top section here, we convert it over to observations.08:34And those observations are sort of a, a 1st set of detections we generate, and then those operations can then generate an alert. Going down to XDR, we're gonna be thinking a little bit differently because of that engine.08:53Evolution again with the goal of transparency, better efficacy, more detection, we are taking the data and we're the 1st step is really mapping it over and normalizing the data. Something we don't review in SDA today is really take the data and normalize it.09:08We just kind of have a proprietary data mapping in the back end and with this, there's some disadvantages to this and I'll cover that in a minute, but essentially we take this and now map it to OCSF and we call them OCSF activities, which are just basically like.09:23You know, something like a network activity, which could be a network connection. We have endpoint activity, which could be something like a process execution. So these are what OCF calls activities, and this gives us a way to take something like NVM, which has.09:40Endpoint context, network context, as well as NetFlow, which has a lot less context and map it into the same kind of normalized data structure, so you can actually search across that data, we can build detections across that data and have it applied to more use cases. So this normalization helps you read the data better as well as helps us build better detections.09:562nd thing that's changing is from those activities directly, you'll notice there's NO more middle analytic layer. So we go right from activities to detection findings. And these detection findings are what we would typically correlate back to as alerts. However, we do have some detections. We.10:15You're building that are more observation like more visibility like, so the concept of a one to one observation or alert in XDR will, will generally hold true for the alerts at least, but there will be some changes. Expect terminology changes, expect title changes, and expect some logic changes to improve logic as we have this new cap.10:33Because this will greatly simplify how we create detections. So it's instead of having three layers from raw data to observations to alerts, we remove that observation layer and we just go right from the activities which are is kind of like the raw data to the detection, which will make it easier to understand.10:53And, and under and comprehend sort of what's, what's coming out of the system. Of course, if you're familiar with XDR, you know that there's actually a 3rd layer, which is called incidents, which does things like correlation, AI analysis. So this is the net new function in XDR that actually didn't have, which.11:12Kind of acts like an alert queue where you can monitor monitor your list of priorities, and this is another lens of analysis that is applied on top of the detections. So just quick recap, this is one of the questions we get probably the most common I wanted to cover as much as some of I know some of you probably know this, others may not, so I want.11:28Wanted to cover how things are being mapped conceptually.11:48Okay, with that. Yep. Thanks. Just before we jump in, there's a couple questions I think would be good to answer as we go through this and then there's others that we will answer and address everyone, but some of them maybe answered by the demo itself when we go through that later in this session.11:53So 1st off, we had a question that Danny's gonna jump in and answer. The question is, will SCA be a separate module that can be purchased or basically a separate solution that can be purchased or will be it only be available with full XDR access? Danny? So the short answer is it will not be a separate module that can be purchased because technically SCA.12:11EA has been end of sale since 13 November 2023, so it's technically not even purchasable today.12:31It's the goal as kind of presenting through here is to make it a all in one solution, right? SDA became part of XDR when we launched XDR. It's why we have the SDA transition program and we try to migrate as many customers from SC to XDR as early.12:39As possible. So the short answer is NO, Tim, it won't be purchasable. It'll just come with XDR like it does today, just in one spot. Yeah, and maybe just one addition to that, if you were wondering if we're going to have that type of functionality available separately after this change, the answer is NO. So there's NO intention to reintroduce.12:57That separately either. They it is fully part of XDR because we believe that that type of functionality is required to deliver XDR services.13:17There's a question around receiving daily alerts for specific alerts on devices that with strange behavior, data very being very helpful, where an XDR can we configure the same alerts to receive information on these devices and can documentation be developed and shared on how to migrate such alerts? So what we wanted to call out in.13:26In General around this, and then we can ask some specific questions in the chat as well is as Logan was just highlighting, Cisco is doing the migration of all of this for you as much as possible. We are migrating everything in a, in a hands off way. You don't have to set configurations, you don't have to move or migrate events. If you had set up.13:45Some sort of custom alerting, it is possible that you will need to potentially recreate that and we'll have more information on that as we continue to progress with the incident tuning and, and the custom capabilities that we're gonna be providing in the solution set, and you'll see more about that as Logan goes through the timeline on the call. But if it is a built in alert.14:05Alert and it is alert that is, that is being maintained.14:25Meaning it's not being deprecated. That's a process that we go through all the time with XDR. So XDR and our native detections, including those that you would see in SCA today. We are constantly evaluating the efficacy of those detections where new detections are needed or older detections are NO longer viable or they're not needed or need to be.14:28Supersededed.14:48As part of this migration and convergence effort, we are, we are reviewing a lot of those ones that we have been pending to review for a while, so you will see Logan present on some that will NO longer continue. I would recommend that you that you take a look at that and see if the item that you're talking about is on the list. But again, if it's a built in item, you don't have to do anything.14:49To migrate, we will be migrating that along for you.15:09There, that's also part of the question around do all integrations from SCA move to XCR automatically? Yes, the answer is that the migration configuration is intended to move automatically for you, so you should not have to do that. You should not have to move anything over.15:15And if, if and only when we move things over, if you have something new to add to the system, we will go ahead and make sure that that is something that's handled you would need to make sure that that's something that you configure a net new, like if you want to add something to the environment. There are a couple of questions that I'm just gonna let everybody know we will answer or.15:30Around being able to see certain types of data in the solution. Logan will not only demo that live, but he will show you what's continuing and what's not in the solution. So we'll, we'll keep going through that and if you still have a question outstanding, there's two options we can address that still later in this call. If you feel that we haven't answered your question, please call that out.15:50In either chat or in the slido Q and A and or you can reach out to your aligned CX customer success specialist who can absolutely dig in further on your specific question if unfortunately we we didn't get into the details that you were looking for.16:10Last thing that we'll answer before we move forward and on into the next section is there's a question around there being two different modules, so I think we should clarify, as Danny mentioned technically everything that you're using today, whether you started as a secure cloud analytics/a CA as the acronym customer or you started as an.16:26Their customer is all part of Cisco XDR.16:45Because we needed more time to fully converge all of the user interface of SCA into XDR, they show up as things like modules today. So technically you will see that you need to integrate your SCA tenant into XDR, but they are not two separate things. However, there's different things like different user accounts and different users.16:48For access and we never, we never made those the same in SCA because we knew we were going down this convergence path. So all user management as Logan called out.17:08For XDR moving forward happens out of security cloud control where you can also connect your own identity management solution for group verification, for authorization and authentication, and then moving forward, there is NO separate SCA console after 24 October to manage. All of that user management is available.17:18In XDR and anybody who has access as you've defined per their role in XDR will be able to see what you want them to see in XDR. So when you see the mapping that Logan will bring up in a minute of what's moving from where something is an SCA to where it now is in XDR, you'll see what they would have access to based on the user.17:38That you've given them access to the role.17:57Okay, Legan I know we have a lot to cover. Keep going and we'll keep working on questions. Yeah, great question so far and I think that we should be able to dive into quite of this in more detail as well. So we wanted to start with just sort of a recap of timelines. We're gonna share with you a much more deep dive into all the things that are coming between now and October 20.18:004th so you have a much clearer picture along with all the emails you should be getting now at this point in time.18:20From from us over on next year team with this data. But just to give you a recap, as Danny said earlier, we had an end of sale back in November 2023. Our original goal was to get this whole migration done within that year timeline we didn't quite meet that goal because we had quite a bit of other exciting things being built next year.18:25So we maintained the two SCA and XDR councils separately, but as we called out, you know, XDR customers were entitled to SCA and SCA customers were entitled to XDR, so they were, they were really acting as one solution.18:45But with two different user experiences. In October 2024, we started with this this migration journey. You may not have noticed it, but the the Meraki configuration where we had this direct cloud to cloud Meraki configuration that was actually built natively in XDR although it passed data through secure cloud analytics.18:58So we were using some of the backend pipeline from security to process the data, but the configuration and everything was was done through XDR. During 2025, the early summer, we had a few new features that were built that I'll actually demo in a little bit.19:15But these features were focused on getting some microlink functionality in XDR or migrating functionality in XDR that we had in SDA, so the detection findings viewer along with our activity viewer for NVM that's actually a little bit later, i'll cover that. Detection findings viewer was meant to sort of replace our.19:32Give you a list of all the alerts coming in next year and start moving down the path of the same kind of detailed pages and things you can see in SCA to investigate alerts. That was also done for other for all XDR customers, but it was targeted towards replication of what's in SCA.19:51The GCP configuration was the 1st migration we took from analytics and moved over to allow only new configurations in XDR, so you can NO longer add new GCP integrations through through SCA that's through XDR. Looking into this calendar year, as we move.20:06Towards this 24 October date, we had.20:26Quite a few updates since last May familiar with NVM and you've used that function, you'll definitely note there there was a major migration there that occurred with both the telemetry showing up in XDR under the XDR investigate activities function, which is like the event viewer and then the actual detection.20:28Themselves NO longer showing up in security cloud analytics and only being, only showing up in XDR. So this is like a pattern I want to just call out that we set within VM that all of this feature sources I'm gonna present, whether it's detections from netflow detections from cloud, are gonna follow the same pattern as we cut them over to XDR.20:49So essentially what happened on 15 May was we we had a bunch of NDM data floating next year prior to that and on 15 May we physically stopped generating detections into the old engines, and we only started generating detections on the data.21:08In XDR, with the new engine. So what that meant was customers would NO longer see detections showing up in the alert list from NVM on that date, it would only see them in the XDR detection findings viewer and incidents, and the detection settings themselves.21:26Were actually moved over to XDR, so I'll do that as well for you but basically if you're familiar with the alert settings page and then security cloud analytics, that NO longer showed the MDM detections. They were taken off that page and they were moved over to the XDR page where you can configure, and that's what a cut over looks like from a.21:43Perspective. So just wanted to share that in more detail because that's what you you will expect to see as you think about the rest of this stuff coming.22:03Going going beyond me, we started to get down into more and more of our telemetry being sent over to XDR so customers could start experiencing it. So this would be like our network session traffic in particular in the event viewer starting to actually show up in XDR.22:10From 22 July through 26 August, the last during that month period, we actually moved over and started normalizing the activities as well as presenting in the activity viewer data from Rocky NetFlow from OCI, ONA, and then CTB.22:26Now, while we are, you know, making data visible there, it's still gonna show up in the event viewer for now because we have not finished cutting over the detections. So until we actually move the detection engine to the new engine in XDR, we're gonna still send data over to SCA.22:43And we'll still be generating data in the event viewer as well as generating the detections in security cloud analytics user experience. So you're only gonna see the data showing up kind of in two places at this point. You're not gonna see, you're still gonna see it in FA just as a note. Now, we're working towards the 24 October date when there's NO more user experience, you're gonna see that.22:59Don't time again, but it's just kind of a reminder of what your destination is across the board.23:19I've broken out the next couple of sections by categories, so you're gonna see some upcoming dates, good to pay attention to you, you're gonna see these in the emails as well, but they're broken out by the actual log data. So the data we're actually ingesting into XDR and showing up in the event.23:24Part of the activity viewer, which is like our event viewer in XDR. It's broken out by detections and then configuration. So sort of the main buckets I showed in that user experience page earlier is broken up that way. The on 16 September, we are focused on the cloud network flow, so that would be from Amazon.23:41Google and and Azure, taking that flow data and starting to make it mapping it over to OCSF activities and then having it show up in the activity investigate activities page. Again, you'll still see it in the event viewer, but the.24:01Data will be visible in XDR at that point. 30 December, we start on the audit log activity, so this would be from the different sources like Cloudtrail, Azure activity, the Azure audit logs as well as GCP audit logs showing up in the the activity viewer.24:17And then at that point in time, that will be all of our, all of our activities or all of our log data mapped over. Now there's a couple that were still sort of planning dates around, you know, in peer transparency, which would be the other network activities, so not non activities like.24:34The ETA data, e.g., is a network activity, but it's a subset of network traffic. We're trying to figure out how we, you know, what the date's gonna be for that one, but this covers the majority of the sources customers have. Moving over to the next section, it's it's about a configuration.24:55So when we look at the different things we can configure in to really make the detections work, there's a bunch of different things here, but the 1st one up is on 23 September is focused on the Amazon Web Services integration. Moving it over to the XDR integration page.25:11So again, this, this does not mean you have to do any work to reconfigure this integration. It's really taking the user experience, taking the, the ability to manage and monitor Amazon Web Services as an integration for the detections.25:27And it's moving it into xdr's integration experience. Number 30th, we start building out a few things here in XDR that replace functions for both configuration and asset inventory. So and I'll cover this as well in the the demo.25:43But in the, in we have a device inventory that essentially takes the raw data and builds out a list of network assets from that raw data. And on top of that as well, you can configure things like subnets. So.26:00Those are both moving over to XDRS insights, which is a very similar function but expanded and that it's an asset inventory, and then the subnet configuration is also moving over to that space so you'll be able to keep the same subnet configuration functions you have today.26:16As well as what we are gonna migrate what you've got configured. It's not you have to go redo anything there. So we will migrate the existing subnet configurations you have. We actually use those for detections, they're very important, but there'll be a new location within the overall context of XDR asset insights.26:34On 14 October, we bring another couple of critical functions over to XDR that are important for configuration. So incident tuning is a piece we're building out right now in XDR, and this is to replace the snooze function.26:50So you can see these alerts by timeline, you can have them hidden from your view if they're if they're not applicable, and this is gonna be replaced by XDR incident tuning. We chose to do this at the incident level, not the individual detection level because the incident list, as you'll see in a little bit in the demo, is where all the magic happens in XDR.27:05And that's gonna be the new kind of.27:25Management plane for the alerts and detections in XDR if you're not familiar with that. Within the incident tuning function, we we plan to replace the exact function this news feature offers, and then over time to actually expand it to be to fill a lot of the gaps that we're in SCA. Like e.g.27:28Process level or path level exclusion rules or suppression rules would be a great example of where we've gotten a lot of feedback that the current snooze function fell short.27:47Also, we have custom detections that customers have built, they're called watch list. Those are being the configuration of those are being migrated over to XDR. As we're gonna call it earlier, some of them are kind of changing. One of the challenges we had with watch list for e.g. in the past are.27:58They, they weren't always clear when they fired or they didn't fire when you expected in the fire because we had some hidden logic. We're trying to do our best to remove a lot of that hidden logic in the new experience so that it's very clear, like if I have a country watch list, e.g., I I would see a an actual detection if I committed if I communicated with that country.28:14Versus today it sort of requires a bunch of, you know, hoops to jump to actually fire and it's not clear. So with that, we're, we're looking to see how we migrate, you know, existing watch lists and rules over, but knowing that there's gonna be some change to how the things work to make it better, hopefully for our customers will be part of this evolution.28:32And then lastly entity groups, not all of our customers use entity groups, but it's essentially like a group asset label that gets applied to a set of network devices by its network range or network IP. This is gonna get moved over in a similar concept over to asset insights.28:51And within asset insights, we already have these things called labels that you can build rules around like, you know, set up a priority score around an asset based on its label, so this will get moved over to that asset insights function like subnets and be context on top of the asset inventory.29:08We, we won't necessarily have the same exact entity group configuration, but it'll be it'll be a similar replacement. And then lastly, before I pause again Brianna for your questions, we have the detections, this is where a lot of our questions come in earlier, so.29:25Just as a reminder, when we move the detections, it physically means we're actually moving the actual engine that generates the detections as well as the configuration of the detection. So we say these detections are being moved over. It means they're being removed from the engine as well as the user experience, and they're gonna start being generated from XDR. So that's the process.29:43Well for NVM, this was very, very quick process. We already had.30:03Detections for customers running in the background that we weren't showing you to make sure everything's working right. And we essentially set a date and time and we said we NO longer will send generate detections in XDR and we turned off the user experience 1st analytics in the engine, and we spun up the one in XDR. So it was a very quick.30:07Changeover period with, you know, NO duplication of data and things like that that you should be concerned with. Yeah, thanks I think I think we're, we're doing well on explaining it through the through the presentation because we didn't necessarily see a lot of questions coming in. There are a couple of questions that we can address around.30:27Around the items that may not be shown here. So just to reemphasize what Lugan is saying, we have been doing this for over a year now. What you're seeing is the culmination of a lot of planning going into how we complete this process and a lot of that effort.30:47Holding into this this current set of three months between August and October. While it may seem that there's a lot of detail here that you need to absorb, we do want you to know that there's, there's really been a lot of consideration and planning going into this into, as Logan mentioned, how do we bring things up in the XDR view so that if you're used to looking at that data primary.31:04Really an SCA or only using the SCA console you haven't taken advantage of maybe some of the other benefits that XDR on Mask provides for your organization yet.31:24That you can go look as these things cut over and make sure that you're seeing the telemetry that you're used to seeing, that you can see that context to search through it, that if anything is missing that you can call that out. We've had a couple of customers so far, just as an example, find that there was an issue with their environment. It had nothing to do with the migration or an issue with the migration failing.31:33That maybe something wasn't connected or functioning as expected and and this helped them find that. So our the ability for you to see things in the XTR console before they're completely shut down in the secure cloud analytics console and for us to do as much of this work for your organization and make it as.31:53As Seamless as we can is, is why you're seeing the level of detail, the steps and stages and the migration milestones that we're taking care. There are a couple questions around things like sensor configuration and health or ICE data. You may notice a couple things like ETA data or certain sources like firewall not listed on here yet.32:13Our teams are still working through what the timeline will be for delivery of those items, so just want to double click and reemphasize on that. The reason that we have these webinars that we have another webinar in the beginning of October, in the middle of October and that we're sending weekly emails to recap what has happened if anything in the migration the week before.32:33Four and then what is occurring for the two weeks after?32:53Is that we want to make sure that you have updated information as we have it if any timeline would shift or move or if we haven't been able to provide you with a date on which a certain source type or a certain capability will be moving over yet, please join these webinars, please read those emails to make sure that you have that updated.32:57Information and we apologize for the items that we haven't been able to put a solid date to yet, but the team is working really hard to make sure that we can get that context over with the same mindset of at a minimum, we should be doing the majority of the work for you. So we're hoping that you can work with us on being aware of it and mindful of it, but knowing that you yourself will.33:17Don't have a lot of change management or process to go through and so if it's coming in a little bit of a later date, that that can hopefully be viable for you.33:37One quick question that we'll take before we continue to move on Logan is there's a question around Cisco identity intelligence being integrated, so Cisco identity intelligence is integrated for the asset context, they believe the question is more so around bringing the detections in in a more native state. That is our intention, but we have had to pause on that work.33:46In order to get the secure cloud analytics convergence as a heavy priority for us to make things more efficient, to move through that process. We've had to put that in, in a lower priority on our roadmap. But what we did release earlier this year is the custom security event ingestion for identity.34:05And while ideally Cisco was integrating that directly for you, it does provide the opportunity to bring the actual detection events, the ITDR events from identity intelligence into Cisco XDR ingested into the data lake and for the correlation and analysis and incident consideration. So we would highly recommend that even though.34:22We understand that's an extra step and it is, it is unfortunate and we apologize for that, that you take that step today. And again, there's there's webinars that we've presented on it for the quarterly webinars that we usually do with customer success for our customers. This is a special quarter for Cisco, we're doing all once a month to make sure that we can keep you up to date on this, but we.34:42Would highly recommend going and setting up that custom security event ingestion workflow to get those identity events in as part of the correlation process.35:02And then just the last thing that I wanted to reemphasize on what Logan is saying as the product team here is, is bringing this information to you is that many of the changes that we're making for this type of functionality in XDR as we bring it in from SCA is taking into account feature enhancement requests that our customers have made.35:11We weren't able to address in the SCA console, so things like speed of the analysis of the data, of the ingest of the data of generating those detections, please note that even though we weren't able to achieve that in the secure cloud analytics architecture, that is because we needed to modernize that architecture in order to achieve those goals. Things like you'll see look and present in a minute.35:30Around the usability of the user interface and the speed of the data loading and the user interface. Many of those things have been considered as well and that's why not everything is being brought over like for like. It's being brought over in the context of how does it serve the outcomes of what you would expect from an XTR solution, but also by addressing those challenges that you were having previously.35:50So with that Logan, let's keep going. I'm sure most of the other questions that we have so far will be answered by what you're gonna show. Yep, thanks Brianna. Awesome. Yeah, stopping point there to jump to the next section. So I won't run through each of these, but this just gives you the the review and again pay attention to the emails as Brianna said to really get the latest and greatest.36:10Based on dates, but this is, you know, kind of gives you a view into what's left in the migration for detection.36:30If we didn't if we didn't catch it earlier, I just want to remind you again before I go to the demos, it's important to be thinking about that, that 24 October date. At that point in time, we'll, we'll see it again.36:40The SCA user experience becomes unavailable, so when I start running through the next couple of slides and and demo here, really be thinking about, you know, your workflows in SCA and how those are gonna live in XDR and and start, you know, using it today if you're not for those workflows because it's certainly possible to start using it today.36:51Alright, I will again I will demo most of this but I want to just give you a mind map of how things sort of relate and are mapped over. So in security box much like earlier, this is kind of a double click into the, the diagram I showed earlier which.37:12Which is we have concepts in SCA SCA today around detections, which are alerts and observations, maybe event viewer, the device inventory, we have web hooks and exports of data as well as notifications and we have configuration and security cloud analytics as well and additional customization.37:27These concepts are going to live on an XDR that as Brandon said they may change, but we wanted to know, you know, we've really taken analysis into all the user experiences we have. We've looked at the enhancement requests that Brianna called out as well. And then on top of that, we looked at usage data as well as.37:45You know, as well as where we've we've kind of been maintaining like functions across multiple pages to do the same thing to try to really consolidate and convince it and make it more simple. So with that, all these things on the leftover here, which are are really our core workflows or core components of XDA have a home in XDR and.38:05They're mapped to different terminology, different workflows, but the concept should live on. So alerts become the detections and incidents. The event viewers talked about earlier becomes activities under it within an investigate function. The device inventory cloud analytics, the asset inventory there becomes asset insights and device insights in XDR.38:22The webhooks and exports, we have XDR automate workflows and XDR APIs to actually serve those same use cases. And then we have the configuration tuning, a lot of the core things you need to configure to get them a detection.38:42And make it valuable, those are all getting migrated over to XDR in different concepts, so incident tuning, as I talked about earlier is the replacement for snooze. We have asset values, which are gonna replace subnet sensitivity. Asset values are something we configure in asset insights, so you're gonna be able to go and take like let's say an entity group or a subnet.38:58And you're able to say this is the valued asset or higher valued asset and that will actually move the incident priority up or down. So the concept of some of that sensitivity is going away because we've gotten a lot of feedback over the course of times that it's kind of confusing and hard to understand and doesn't always work to do what customers.39:18Wanted to do and what we've with the new engine and and evolution we're making on the detection engine.39:38We are really looking to simplify things and so we're focusing out out of the box priority scores versus subnet sensitivity being a driver that can help us take things like, Oh, this is an informational level event. So it's gonna be informational level severity. Oh, this is, you know, we've seen this across adversaries commonly used by.39:44Commonly a commonly used technique and we're very high confident if we see it, it's gonna be critical, so we can rate that as a critical. So helping us sort of build those out by default out of the box versus trying to have this whole complicated matrix of configuration to things to to hide things. And then of course that with the incident tuning I called it earlier.40:04Replace and hopefully expand and make the actual tuning and what you're seeing much more efficient than it was in SCA. Okay, so that's what's gonna be in XDR and how things are gonna go, what's not gonna be moving over to next year.40:22And again, looking at a lot of the usage analysis and a lot of the feedback, there's definitely things that aren't see that are, you know, I personally like the look of them, but they weren't always useful or tactical for customers and use day to day. So just kind of to to kick that off.40:38We do have things that are really important in SCA that we will have an XDR but it'll be different as things like account management, the administration functions we have user management is one of those big ones, developing email notifications. These are gonna be an XDR. It's just we're not gonna migrate them like for like.40:55As they're in SCA. So I probably should have had this on the previous slide, but we have things like security cloud control which has actually enhanced, you know, user management that we didn't have in SCA. We have the, you know, the user account management in XDR. These are all things that are gonna be part of XDR, but they're just gonna exist as they do today, so they're not really.41:12Be like we're not migrating settings or anything like that because the paradigms are changing so much.41:32So that's why it's called out of this page. There are other pages that we have, you know, nice visualizations on that are gonna be not brought over to next year and a lot of this based on just usage and feedback and value as well as enhancements that were, were needed.41:36So one of those big places is, as I called it earlier, we have the event viewer. And the event viewer was really a version two.O of a lot of our network reporting and network search pages. So we're only gonna migrate one activity network or sorry, one, one activity viewer log view.41:52INDEXTR, we're not gonna have a separate page for each search. Our goal is to have a single place to go search and enhance that search function so you can more easily search across that data as well as it being normalized, which was the case before. So we don't need all these different pages to go search data.42:11We're gonna try to make that as efficient as effective as possible on a single search, which will be the XDR activity view. So if there are missing things there, that's where enhancement requests and things come in around that experience. We're not trying to you know recreate individual pages in SDA around data search.42:27There's also a lot of reports that were built around that that help you slice and dice data. Those aren't being migrated as well just because our goal is to really, again, put it around the single user experience. So none of the traffic reports or any of the other search by IP, those aren't being migrated.42:45As well as SCA we did have quite a bit of report built around the data that we are not necessarily recreating, you know, day one at least on just visualizing data. Again, these were really nice to look at, but we saw not a lot of usage as well as a lot of like action coming from.43:01These reports because they were just kind of, oh, there's, you know, there's data showing up here. So with this, these are the summary reports, the dashboard metrics.43:20Some of the session charts we had in graphs as well as visualizations. So one of the, you know, most common enhancements I often got were these were all missing functions and missing features, so we decided to not bring them over because they were, we're already some kind of part of what we wanted them to be.43:30And over time, you know, we'd be focusing on what's missing in the activity view, what's in our device inventory view to help you take action or help you investigate those devices or that traffic more effectively as as a, as a moving forward action.43:46Anything else there Brandy you want to call out on what's being taken down or what's being, what's being kind of not moved over at this point in time? No, thank you Logan. Just just reemphasizing, right? These are final decisions made, so if you're leveraging these things, please understand how.44:03You would use this type of functionality in XDR separately. If you're not used to using that, please familiarize yourself with that. And if you have questions, please do engage with your customer success manager for that.44:21And then I think one clarification, sorry that just popped in while you were about to keep going. There is a question about if event viewer session traffic and session details will not be migrated. No, that is not what we're saying. So what we're saying is that there are standalone traffic search and reporting pages. Boss, we will get to your question. I think you asked it in the Q and A.44:34Section as well. I'd like Luken to go through his demo so that she can see what is going to be available in XDR and then we'll come back and and understand if we've addressed that for, for MMC.44:54Great call, yeah, we'll definitely cover that. So then the last piece is really detection life cycle management. So as we called it earlier, we, we are kind of re we're evolving the entire detection engine, and with that, we've used the time to sort of rethink a lot of our detections. Many of them are still very applicable and.45:07We're still gonna get brought over one for one out of our, you know, few hundred detections, there were a subset of those detections that we worked with our our threat research team to really accept and evaluate usefulness, helpfulness relevancy to modern threat tactics and techniques.45:27And what we're, what we came up with was a list of these detections that we determined we would actually not migrate over directly one to one and have the replacement for at this point in time. So essentially what, you know, this is as a process that we normally go through. We just don't call as much into it and.45:44We're kind of using this evolution to take a good hard look at what was there.46:04And especially in areas like network behavior detections, and some of the cloud visibility that, sorry, there's a couple one on here that shouldn't be here, but the watch list hits will get migrated to so ignore the list. I inappropriately put those on this list, but.46:08The the rest of these on this list here, the detections will not get migrated because we're, we've assessed them and really looking at, you know, these should, these weren't as relevant and weren't doing what we wanted to do originally, they were too complicated. In some cases, the.46:26It's actually maybe didn't fire at all over the last year in many cases or it actually fired a lot and it didn't really get a lot of useful value or feedback from our customers. We did a bunch of different lenses across the board there to really assess what wouldn't be brought over. And it's important to note.46:43Yeah, I'll use NVM as an example. We brought NVM over, we actually removed a few detections from NVM I think like six or ten, but so so we ended up with 60 migrated detections from NVM and XDR, but we now have a hundred almost a hundred and 20. So while we will take things away, this new capability set allows us to really go.46:59Detections more more quickly. We turn them on by default versus maybe you turn them on by yourself, and then on top of that, is able to really.47:19Control and manage the content a lot more efficiently. So it allows us to keep advocacy up, keep the detection coverage high without as much noise and false positives. And that's where you'll see us kind of rolling some things off here during this con this evolution window, but expect to see, you know, more and more detections get added more quickly over time than they have historically especially around networking.47:29Cloud visibility because of this new engine and its flexibility. Okay, so this is a good time now to just jump over to an actual demo and walk through some of this. So I'm gonna focus a little a lot on what's in XDR today to start and talk through how the user experience maps over.47:48From SCA and then it'll really be centered around NVM, but we'll, we'll cover some of the key operating flows at the end of the day that you would have versus SCA. Pause here and jump over to my.48:06Live environment, so I'm just gonna go over to XDR and again this is just a demo environment, so it's gonna be a little bit different probably than what your environment looks like. However, it'll serve the same purpose we have for today. So to start.48:22Where, you know, most SCA customers start with a single user experience. They land on the dashboard and they go right to the alerts or they go directly to an alert from an email or from another 3rd party product. And the alert list is really the bread and butter of security. It's where we take the data and we make insights from the data.48:40And in XDR, this is, this is the incident list. It serves very much the same purpose as the alert list. It gives us a prioritized list of actions, it gives us actually quite a bit more than I see I'll cover in a second, but it does things like assign, create a state, like status for the actual.48:59Incident. So very familiar if you're with if you're doing things like assigning and closing out alerts in the SC list, you can do the same thing here on the incident list. What it doesn't do in the SCA that XDR does have is this whole other concept like AI classification. So hopefully you're familiar with XDR, most of you are, but if you aren't I'll just briefly talk about it and not spend a lot of time.49:18But we have an entire AI agent analysis that's done on top of the detections. We've got correlation with 3rd party happening here and then of course in XDR we have the response function. And the whole response function allows you to do quite a bit more than SJ ever allowed, which is mostly an SCA was just an export of data and you had to do this somewhere else, but with an XDR, we can do.49:38Things like contain, execute directly through APIs.49:58To any integrated source like the firewall in this case here. So, I won't cover much more than that because there's a lot more I can covered there, but just know that the alert list, the new place we're really suggesting is the incident list in XDR and it offers a lot more than the alert list ever did.50:02Above and beyond. However, within the incident function, we also have this detections view. And this detections view here, you can see it's showing a list of detections in this case coming from my security cloud analytics products, so things like DNS abuse as well as here, Windows application.50:19Oh, with the telegram connected to telegram, and these are this is the place today where if you've got them integrated you can see all the detections that you would see in the alert list showing up here. As well as the NVM detections, which NO longer show up in the actual FCA alert list. So you can see that here we have a link back to Cisco XDR, this goes back to and here we tea.50:37Well, so as detections move over.50:57And in terms of the engine itself and where they get generated, once it moves to XDR, there is NO link because it's an XDR. We still keep the link for the old engine, but for, you know, for our call to action here today like we've said, just really start understanding the workflows if you haven't, this is where a place you can go to really start seeing your existing SCA data show up in.50:59They are.51:19And I'll give you one more quick view into that, that's really important to see is if I go to this view details page here, you're gonna see a very similar look and feel to what was gonna see it. You're gonna see the MITRE context. You're gonna see this this activities view as well as some additional things you couldn't do, which is see the raw data itself. And what this lets you do it lets you view the details.51:20Of a given detection. And you can see in this case here we have the detection name, we have the minor context that we discussed, and then this thing called activities here. And you'll see there's NO more observations because as I said earlier, these get removed, but the activities themselves are kind of like our summarized.51:40Raw data that was the actual evidence of the detection. And here you can see about all the context here in this pane here. And then the really cool thing is because I talked about normalization earlier, because we normalize data.51:59We use OCSF for our normalizing mechanism and that's an open security framework standard. This lets us take something like this detection and bundle it all together with this, so it's all one big blob of data. And if you go look here at the actual raw JSON, you can see.52:14It's all buggled together. There's not like a separate raw data. It references, it's all in one big blob of data. So it makes it much easier if you're exporting data to get the data out of the system and it's it's much more robust too because mapped and normalized so you can actually see, here we've got all these fields that are mapped.52:29To activity field. That's so that's kind of like how detections and alerts map over to XDR and how you can use it today to start checking things out. Additionally, the detection settings.52:47So, as I talked about earlier, as detections get migrated over into XDR, meaning they turn off from getting generated into we actually moved the whole configuration over here and we turn it off in SCA. So what you're looking at here is a list of NDM detections that can be configured because we've migrated those already.53:02In XDR, and you'll see it's very similar to the look and feel of the settings page, and then additionally, we've got a few more things you can do here. So within XDR, as I mentioned, the incident list is really where we want you to start.53:19Your day to day work. So it's kind of like the SCA, and what we suggest for customers is keep the default settings so there's a bunch of correlation rules, again I won't cover that today, but a bunch of correlation rules, promotion rules that we've already built that take these detections, analyze them, and then promote them as end to ends.53:35If customers know, want to make sure they're seeing all their data, they do an SCA today like the list in XDR, we have offered other other mechanisms where customers can go see certain detections directly as an incident. And we've got this advanced feature here, which is.53:52Really going to always create an incident once we see that data. So if we see, you know, this windows browser connected to any webhook show up and trigger this rule, it will automatically create an incident if I have this checked. If not, it'll just go to the default incident analysis logic and it'll show up in the detection list here.54:08Incident detections, then it may show up in an incident list if it meets the rules for an incident. So we again suggest trying out the default mechanism and if that doesn't you know meet your needs, you can always go and configure things on here to get the parity of what the alert list did. The last piece I'll talk about and then I'll pause is the incident activities. So this is.54:25Sort of our replacement for the event viewer. So to answer the question earlier, yes, we're gonna have an event viewer, it's just called XDR activities and it's been normalized to CSF. So in this case we have.54:45Existing in XDR today we have network activity so far, but this will get expanded to other sources like cloud logs. And what this does is it takes all network activities from NPM NetFlow, cloud netflow, and merges them all into one view. So much like our network session did.54:54And allows you to run a search on that data. So you can see here I've got Cisco Meraki, Cisco MVM, Cisco ONA, and Cisco telemetry broker, and then Oracle already showing up here because we've, as I discussed earlier, you've already started to send this data over next DR and you can actually try it out yourself and by running a search by clicking apply filters.55:09And you'll see this search will run a run a query based on the parameters you put in and it will return all that data back from all those different places in one view. So all of your network activities in one view and allowing you to search across it and see a very similar.55:29Output like you saw, like you can see in SCA. As mentioned as well, we tried to really focus on search query time. I just trained a pretty big query here, which I should have done for a demo, but it allows you to really allows you to more effectively search that data and.55:46The other big note is as the data gets pulled into XDR, we can actually detect on that data more effectively than we could before. So our detection is much more was much quicker, much more quick to actually trigger those rules as we see the data coming in closer to, you know, closer to the time we see the actual event occurred.56:03So here's a quick view of the actual output of that search, you can see all the different fields here showing up, you've got column settings, much like you do in event viewer to go and filter all the things you want to see in the list. And we've got some default columns here, of course, so a much, you know, similar experience to event viewer.56:22Alright, I'll pause there Brianna. I wasn't gonna cover asset insights, but we're getting close to the end of time here and I want to make sure we get time for any last minute questions. Yes, for sure. So there was a question around whether or not SCA emails about new alerts will migrate over. I'm not sure if the the party had was able to attend some of our earlier webinars. So this is the, the web.56:41Change that Logan had mentioned, you need to configure that directly. So we've provided some guidance in an earlier email.57:01There was a webinar that happened earlier in April that addressed this or May I maybe getting the month wrong and all of that is available on our convergence pages that we can share those links for as a follow up to this email and we'll drop in chat for a minute. But we definitely would need you to go ahead and and reconfigure that XCR has its own notifications functionality.57:09So we're not moving those over. We're not we're not going through that process.57:29Okay great and I see some of the incidents showing the next year don't have any AAA classification. What can be that reason? It's unrelated to the SCA convergence just for everybody's awareness, but it is one of two things. It's either a single event that's being auto promoted in a way that we are deprecating or it's an older.57:35Incident that did not go through the AI processing when we had it. So some of those incidents would be subject to your time of of retention in your system, but that would be the case most likely. If you're seeing that a newer items, if you can search and see that that's related to a newly created incident, we would recommend putting a tack case in.57:56Okay, and I don't see any other questions. I guess we'll say we have about 30 s left. If anybody wants to drop another question in, please do so While we are dropping the links in for the different pages that you can go to to access our.58:18Our ongoing information around the timeline. Any last questions or Logan anything while we're waiting for questions that you wanna call out? No, I think I think it's really this last couple of items here we've had this on this page, so.58:37The two slider questions, but I feel that we've answered all of those. I'm sorry I'm trying to understand what we feel we've missed. We've talked about the SCA to XTI transition center saying event capabilities are moving into next year investigate. Does this mean all event viewer capabilities will transition? So that is what Logan was.58:54It's demonstrating just now in the activities view. I guess the question is around investigating traffic on a subnet or range of IPs during a specific time window and filtering on the amount of traffic bytes in and out. Maybe if you wanna take a minute Logan on the filters. Yeah, I'll jump back over to back quick here.59:13So if I pull this back up again, under investigate you can see we are doing our best to really, sorry about this one, activities. We're doing our best to really continue to expand the filter selection here. So while this in this case does not have everything that was in event viewer, we are, you know, continuing to try to add on the missing.59:31So the the bytes count is a good call out.59:52We, you know, like I said, I I don't know exactly where we'll land with all of the exact filters at the end of this 24 October date, but the goal here is to really do this place where we actually have everything that, you know, a customer needs to filter on and search on is available in this list over here on the right.59:56Yeah, and and so understood, if maybe that's something you use heavily today, we're working with the team and changing to the new interface and making sure that we keep it performant. There are some things that we need to consider about that. Peter I know we're over time, which just maybe I understand maybe we're not being specific enough in the answers in some of these questions and we're certainly not trying to avoid.01:00:12So I want to make sure we're being clear. 2nd question was around the ONA sensors collecting NetFlow, how can I manage them in the XTR interface? My answer earlier about when you do not see on our migration list yet a date for an item that you're expecting to be cut over, that was the answer to this question as well. But to be more specific, we're.01:00:32Working on the timeline of when the configuration and management for sensors would move in. So please stay tuned as Logan mentioned, reading our emails is critically critically critically important. So this came in as a new question now as well, which I'm answering. This is gonna be critically important and keeping an eye on the the updated.01:00:52Timeline that we will continue to update in the links that I'm providing in a minute, as well as this readiness plan, right? If you have not activated Cisco XDR already, if you have not migrated those webhooks and you have not started using XDR actively, we really need you to do so, so that you can help us understand even better moving forward and reach out to your customer success team member if you are seeing.01:01:12Something that or if you're not seeing something you expect to be there.01:01:32For those who can stay on the line, there's one other question Logan that I would like us to address live because I think you can show up pretty quickly in the demo and and maybe refer to what you were already showing for the JSON. Is there going to be an option to download the results like there are in SCA? So I know for some of that we showed the individual detection. Do you wanna address that a little bit further?01:01:36Yeah, so I think if you look at like the the missing kind of pieces here that are exists so like the detection view as well as the investigative activities view, we do have a download option in SCA. We know that's a gap early in XDR and this is something we're working with the team to sort of scope out and make sure we've got eventually.01:01:56Available to customers. The other option of confidence is using an automate feature.01:02:16Today we have we have much more robust set of APIs we would suggest to use and you know if you want to export this data somewhere else you can play with it, this is another option to to use as well through a workflow that would just use the actual API context.01:02:23Awesome. So with that, we are gonna close out with questions just to be respectful for everybody's time, our customers and our partners on the call. We thank you so much for joining today. As mentioned, please continue to join these webinars, but if you have questions in the immediate term, please reach out to your customer success team for partners, please reach out to your partners.01:02:41Your support team members and if you, if you find something that you really can't can't get the information on or you're wondering about.01:02:59Please reach out through, through those team members to get answers and keep an eye out on our emails. If there's not a date that's present, been presented for our functionality that we have indicated we intend to migrate, then that date is coming. If we have been clear that we cannot.01:03:08We will not be migrating that functionality then it will not be moving over, so you you would not expect a date coming for it. Peter, back to you. Great. Thank you Logan and Brianna panelists and the whole team for bringing your knowledge to the Cisco community. Your feedback is important, and at this time it will be redirected to our event survey, please take a few minutes to participate and let.01:03:24Let us know how well you enjoyed the content today. Once again, we thank everyone for joining and we will see you next time.01:03:44