Introduction to Cisco XDR

Okay, time is up. Okay hi everyone.00:00Let's start. Good morning, good afternoon, good evening, everyone, wherever you're joining from. Thanks for joining. Welcome to Cisco Expert insight series and thank you for taking the time. Today's session is an introduction to Cisco XDR.00:15Over the next hour, we will cover what XDR is, why it matters, and how Cisco XDR have obtained C, prioritized and thereafter response to track faster.00:30Then before we dive in a quick introduction, I'm Wayne, a security customer success specialist here at Cisco, and with me it's Mary, also a security customer success specialist. You'll be your presenter and host for today. Between us, we work with customer every day on how they build.00:48And run their security operations, onboarding them into Cisco XDR, connecting it to the security tools that they already have and helping them respond to threats. That hands on experience is what we will share with you today. Towards the end, we will take you through a pre recorded demo, recording it let us.01:05Show the complete analyst workflow from start to finish without connecting issue, it's in your time.01:26Before we begin, let me cover a logistic item item. We'll be taking question through Slido, which you will find in the panel on the right of our screen. If you can't see it, look for the Slido tab in your meeting window.01:38Feel free to submit your questions at any time. We will monitor them throughout the session and address them as we go along. Very relevant. If there's a question, we can't answer on the spot, we will do our best to clarify it and follow up after the webinar or through our community space.01:53With that, let's take a look at what you'll be taking away from today's session. Before we dive in, let's kick things off with a quick warm up. I want you to imagine this, a security alerts fire in your environment right now.02:10Your team jumps into action, but how long does it take to investigate, response, and resolve it? Are we talking about minutes, hours or even this? Take a moment to think about it and keep your answer in mind. We will come back to this question later in the session and see how it ties into this topic.02:27So, most security teams we speak with already have good tools. The problem is that those tools at times don't talk to each other. So analysts piece alerts together manually while threats keep moving faster. That's the problem Cisco XDR is built to solve.02:47So what will you take away from today? There are two main objectives, as you can see. 1st, you will gain knowledge of Cisco XDR. We'll start from the basic, what Cisco XDR is, why security teams are moving towards it, and where it fits alongside the tools you already use.03:04Second, you understand the different components and features of the XDR solution. We'll look at how Cisco XDR is put together and what each part does so you can see how the pieces work together and what that looks like for an analyst day to day.03:22By the end, you should be able to explain what Cisco XDR is and how to navigate through it. So how do we get there? We will break to this session down into five key parts taking you through each step along the way.03:391st, what XDR is and why it matters to the security operations. This is the foundation and it covers our 1st objective. Second, the outcome XDR is meant to deliver for our team and the components behind them. 3rd.03:57We'll bring those components together and show how Cisco XDR works as one solution. Part two and part three covers our second objective. 4th, the user experience, this is the point of view from the analysts what a day to day investigation looks like and finally, the demo where you will see.04:12All of these in actions.04:32Let's start with the overview and the value of XDR it brings. So you may ask, what is XDR? It stands for extended detection and response. It basically takes all the signals your security tools already produce from either a network, cloud, endpoint, email, and even beyond and connect the.04:37Dots for you. Instead of chasing five alerts in five different console, your team see one story and can detect, prioritize, and responds faster.04:57A good XDR solution should tackle your most pressing security operation challenges which in turn give you three benefits as what you can see in the slides. Simplicity, XDR integrates with the security tools you already have, so they work together of the box instead of in silo. Visibility, this is a big.05:08One, after all, you can't protect what you can't see. Having clear visibility across your environment is the 1st step towards detecting threats and responding effectively.05:27You get one central view of your environment, machine learning analyze the data and links related alerts. So your team detects and investigate threat faster with the full context. Lastly, efficiency. XDR automates routine tasks which cuts the team workload and speed.05:38Remediation. That lower the cost and strengthen your security.05:59Thanks, let's take a look at what it means in terms of outcome for our team. Most security conversations start with products or which tools do we buy, which feature do we need? We, Cisco XDR, start with the outcome you want your SOC to achieve.06:04And these are the five we focus on. Think of them as the life of an incident. 1st, we want to detect sooner. Every hour an attacker goes unnoticed, give them more room to move. So the question to ask ourselves is where are we most exposed?06:23Second, prioritized by impact. Your team probably see thousands of alerts a day. The loudest one aren't always the one that matters. The aim is to put a text that could really hurt the business at the top of the queue. 3rd, compressed investigation time. This is where analysts lose.06:42Hours jumping building console to work out how the attacker got in and how far they have gone. He want that answer in minutes.07:024th to accelerate response. Once you know what's happening, how fast and how confidently can you act? This is where the automation take the loads of your team. And last but not least, extend a set context. None of the above worked well if you can't tell which devices is affected.07:11And who uses it. That context ties everything together. So an XDR is really an expression of our business needs. Before looking at any product product, ask yourself where your team is because across these five, that's where XDR should help 1st.07:31This slide shows what sits behind them instead of going through every box, let me show you how it works with a simple example. Just imagine a suspicious sign in in one of your user's account followed by an unusual process on their.07:51In most SOC, there are two separate alerts in two different tools and someone must realize they are connected. In Cisco XDR, because your tools are integrated, both alerts comes into one piece.08:09Analytics and machine learning flat the behavior and the platform correlates them into incident. It then scores that incident so you know it's a priority and a set context, which device, which user, and how important they are to the business.08:27The analysts opened the incident and the evidence is already there. Get it through automated enrichment. They don't spend an hour pulling it together. That's the investigation outcome. Followed by response, a pre built.08:44Playbook or an automated workflows handle the routine step such as isolating a device or blocking the account. If your team needs something specific, the automation is drag and drop. So it needs little or NO code.08:59That's the response outcome. So the column on this slide describe one flow from detection true to response. The bar at the bottom list the six main capabilities behind it. Analytics, incidents, integration, investigation, automation, and device context.09:14The demo later will show this flow end to end. We have seen the outcome and the components behind them. Now let's take a look at what it means for our environment and where Cisco XDR fits. Starting on the left, these are the sources.09:34It's not limited to network, endpoint, email, cloud, and identity.09:54And in factive XDR can't rely on a specific product alone. You need all of this running together because each one is only one piece of the puzzle, and that's the advantage of being built on the Cisco security platform.09:59If you're already running Cisco security products in your environment, the telemetry is already there. You are activating value you own rather than starting an integration project. On the extreme right is your wider infrastructure.10:15Your 3rd party tools, your intelligent feeds, and your SIEM. Cisco SDR is open and so in work with what you already have, it adds intelligent asset and user context and even mitel mapping, so each alerts come with an explanation of who is affected.10:30And what the attacker is trying to do. The last thing an analyst need is an up point solution bottled into an early overbuilt security stack. In the middle is the console where all the magic comes together, AI and machine learning analyze and correlate everything that.10:50Comes in across the whole attack chain and every affected device. So you see one story, not a power of alerts.11:11The console use progressive disclosure, you see the key effect 1st and drill into details only when you need it. That helps with something every SOC analysts know. That's how Cisco XDR deliver the outcome we have covered with clear prioritization, streamlined investigation.11:19Automation and respond guidance in one view for the whole SOC.11:39The analyst work day today, the incident responder act fast and even the CISO series. That's where Cisco XDR differentiates itself. It brings track detection, investigation, mitigation, and hunting into one solution across the Cisco portfolio and.11:45Selected 3rd party tools. Oh, this lead to the message in the red bar as you can see. Simplify security operation, raise productivity, and stay visibilant against the most sophisticated track. Remember the question I asked at the start? I repeat the question again.12:04A security alert fires in your environment right now. Your team jumped into action, but how long does it take to investigate, respond and resolve it? Keep the answer in mind, let me just show you a typical sample of what's going on. Just what it means on a typical.12:23Coding or any day when something actually fires and trigger.12:43Starting on the left, this is without XDR and IOC or alert comes in, your analysts that investigate it across separate product dashboard and at times several teams are pulling to assist in investigation. And afterwards coordinate the remediation across multiple teams and console.12:48Getting through that take around 32 min or even more.13:08So I'll ask how much time and how much screen your team pivot between to work out the impact of threat and decide how to respond. It's always exhausting, stressful, and over time it leads to burnout.13:13Now, on the right, with Cisco XDR, the investigation is integrate across your security infrastructure in one view, the analyst query, intelligent and telemetry from every integrated app at once.13:28The hash, the IP, the target endpoint, the email, everything, to see the impact of the trap across the environment, and in less than two clicks, they understand how far it has spread. From the same screen, they will.13:44At scale across our security ecosystem, that will probably take under 5 min. Just compare between these two. That's a saving of about 27 min per incident or about 85 % less time to respond.14:00And remediate an attack. Imagine multiply that by your monthly incident volume and you will have your ROI conversation. Now the real game isn't just the minutes that we are talking about here. It's your analysts never lose the track switching between the twos.14:16Hope this sample give you a great idea on what XDR is capable to do. Okay, with that enough said about what XDR is and what it entails, now is the part where you and your team actually lives in the user experience. I'll show you what.14:34Is that possible, which is what the analysts see when they log in. 1st off, when you 1st log into XDR, you'll land on the control center. You don't pick a product or harm for a console. This page is the starting point for the whole day.14:54The control center is the main page of XDR solution. It's the answer to what should I be worried about right now in your environment. The control center is built around dashboard and they are yours to configure.15:14It's customizable dashboard depends on what's important. Each point product can have its own dashboard or you can combine them as well. You can change the layout, the size, the timeframe, and the skill or even take it full screen.15:29Creating dashboard is very easy and you can customize dashboard to suit your need. This page gives you complete visibility in your environment. You can select the time frame of your event as well depending on your requirement. And normally dashboards are shareable with other users in your organization.15:46So meaning your analysts, your SOC analysts, sock lead, and even your CISO, each can have a view built for their job off from the same data. From the dashboard, you can go straight to incident.16:05This is where the 32 min become 5 min as checked earlier. XDR lease incident prioritized by severity. So the higher risks come 1st and the clubber drops away. Each incident is already enriched.16:22The investigation has started before you open it and the list show the enrichment status. Incidents are created automatically from critical and high security events from different sources. Yes, I know you guys saw the CD priority scores. All your questions.16:40And during the demo later Mary will explain to you how the scores comes about. Moving down will be investigation. What you're seeing here is the investigation workflow. We can run an investigation by entering one or more of the following, be it your IP address, your domain.16:58Your address, your URLs and even many more. So one search, you will be getting a timeline for site thing, so you can see the the other events that actually happens. It's interactive, it has visual representation of the incident.17:17And with that, from the same screen, you can even block the file, block where it's connecting or even cut off the device off the network. Behind the incident seats intelligent, this is where you search the track data SDI use.17:35Public sources and your own private data. Yes, four parts. Judgment are vertics on an item, like an IP address, a domain or a file, be it malicious, suspicious or clean. Each vertic expire after a set time. And you can link to that indicator that explain why.17:53Indicators are a pattern of bad behavior. They show what an IP or domain is actually doing, which help you decide what to do next. Events say it's a record when an item was seen. You'll find them under intelligent then events.18:13Please are your own list of bad suspicious or safe items such as your block list, your watch list, and allowed list. Safe and tap up to date. Intelligent tell you what's malicious.18:31Automation lets XDR act on it. It's a way to build workflow that work across Cisco and 3rd party system, including application, database, and network devices. What you see here are exchange, a library of pre built workflow you can import and use right away.18:50Workspace as you can see in the screenshot, is where you build and edit your own workflow with a drag and drop editor. Run monitoring show which workflow run when and whether they succeeded. And there's other photos of settings such as your targets, your user pass, your variable.19:10And even your schedules. Automation reduce human error and let you investigate at machine speed using really make our custom workflow. The last step that I want to bring you through is a set.19:30It shows which device is involved, who uses it, and how important it is to the business. As they are bring device and user data from all your connected pools into one place. So we are NO longer switching between console.19:48You used that context to ranks incident and alert on a critical server comes before one on the left machine. From here, you can search your devices, see who uses them, check which security agent are installed.20:04And whether software is up to date. Tools are already connected to XDR synced automatically, and you can also manage deployment and device profile. Because this that covers the main area of XDR you will use when you get started and introduce.20:20It's tube.20:40This is my last slide and I know you guys are looking forward to the demo, but but but before we jump in, I want you to walk away with these three key takeaways. The 1st one, Cisco XDR pull your security data together from across your entire.20:44Environment into one view.21:01Number two, you add context. Threat intelligence tell you what you are up against and asset contact tell you what's at stick. Last, the 3rd point, it connect investigation strict to response. The moment you find something malicious, you can add.21:04Found it right there right away.21:24So put these three together and your team get more done. Catch the sophisticated threats and remediate faster because you are always working on what matter most 1st. Alright, thanks everyone. Let's see in action. So.21:26So Mary over to you, thank you.21:46Okay, thank you. Thank you so much. So Wayne, thank you for the introduction for Cisco XDR, so I've prepared a pre recorded demo video to avoid network delays or time spent switching between different pages. So I will play the video now. So please feel free to submit your.21:50Questions in Q and A panel or even in the chat box. I will share my screen.22:101st. All right, I hope everybody can see my screen right now. Let me start my recording. Okay, alright, hello, everybody. My name is Mary. And in today's session, I'm going to walk you through Cisco XDR. So Cisco XDR is a single.22:17Low detection and response solution aimed at security analysis and incident responders within a security operation center. As an security analysis might be asking so did anything bad happen and do I need to act on it? An incident responder might need to know some.22:36Something different. So how did this happen and what else should I be looking for? Most teams answer those two questions by opening six councils and reading six list of alerts, but Cisco XDR answers them in one place. So that's the whole idea.22:56Here's the plan. So 1st I will walk down the manual on the left. So you know what each part does, then I will take r1 attack from the list I showed you before and work it from start to finish from one line in the list to.23:16Knowing exactly what happened to shutting it down. So here's Cisco XDR. It doesn't replace any of the tools you already have. It connects them together and run analysis. So Cisco XDR runs in the cloud and it uses AI to group alerts and run them by.23:35Risk. So the control center is the main landing page, the dashboards, and the TA coverage map I will show you later, right? So incident here in our under control center there is incident page, so I open it in another.23:55Tab to save time. So the incident page is the working list where a SOC engineer spends most of the day and where we'll spend most of ours. This is the place that we will have to take some time in and do some investigation here. And the investigate page is.24:15Hunting on demand. So when you try to research something proactively when you come up here, so you given an IP address here, a domain or a file hash, any IOC that you would like to check. So it will ask every product you own if you have ever seen it. So the.24:35Highly.24:55Page here tells you if a file or an IP address is known to be bad using multiple intelligence sources. And of course the automation page right here, the automation page, it runs actually we have automation function.24:56And so automation runs the repetitive work with workflows up here that act on incidents. And about those.25:16Assets, so assets is the place showing us what we know about our devices, what we know about the people who use it and the sources, even under sources we can get an idea of which source is still sending the data into cisco.25:26So, yeah, I will move to the administration page. Administration is where you connect your tools, either Cisco products or supported 3rd party products here.25:48Yes, back to control center right here, right? So this is the dashboard, so look at what it's telling us. So here team mean time to engage and to resolve, so which means how long we take to close an incident. And here about incidents by priority, so telling us how.26:05How many incidents we have at each priority and the attack incidents telling us which attack messages they used and about e.g. like unassigned incidents, how many cases nobody has picked up yet. And the top workflow runs telling us which.26:25Which automatic jobs are still running. So if you run a sock, these how screen tells you where you are slow, where you are exposed, and what to look at today.26:45And this is the default page, but not every SOC team wants the same page, right? And they don't want the same value so you can change all of this. If you click on customize coming up here, if you click on customize, you might create your own dashboard. You can give the.26:57Dashboard and name and pick the panels you want. E.g., you want some ETD, emails threat defense solution coming up here. You want anything about secure endpoint, you want anything about your.27:16A secure malware analytics product. So everything that you want to show on your own dashboard you can create here. So which really matters because a soccer manager or a threat hunter don't want the same screen and.27:32Also each panel coming up here from different products, so you can add your own secure endpoint, your firewall, your network product, even cloud, even identity. So I don't have to open six consoles to find out if anything is wrong in different products instead the whole information just coming up to.27:52Me because this is the demo environment right now it's not showing anything up right here, but actually if you integrate your own products, if you have your telemetry coming in, then they will show up.28:12So I will show you the other page under control center we have the MITRE coverage map. So this is the page I really want to show you. So MITRE attack is a free public list of how real attackers behave. We have.28:2514 tactics right here. So a tactic is what we wanted at the moment, the attackers they want to get in, they want to run codes, they want to steal passwords, they finally, they want to get the data out for vision, right? So starting from recognizance two.28:44U.29:06Two data exfiltration. So there are 14 tactics showing up here and from recon to exfiltration all the way to get the data out, right? So this page answers one question. Which of those would we actually catch? So each pie chart.29:06Here, right? Each pie chart.29:26Is one method, so it tells you basically three things e.g. like command and screwing right this one which of your products coverage, so there are four products showing up here and how many of your own.29:31How many of your own incidents use eight? So I see there are four incidents and which of your product already covered eight and how many of your incident and even how dangerous, right? There is a critical value showing up here. So red means critical. So.29:48How dangerous it is.30:07And this is where that you can tell your finance group how many products we already have and what kind of gap that we already we can fill in. And move to the incidents page. So for things 1st, these rows are not alert.30:10So XDR, takes the role alerts from every product you connect.30:29With XDR. So XDR will work out each ones belong together and puts them into one incident. So each row here showing up here is one case, one incident. It's not one alert, it keeps growing as more information comes in. So look at the sources.30:38On this row, so several products, one case, e.g., like this one, several products, one case. So here's why that matters nowadays the problems with alerts isn't that there are too many? It's that the same attack gets reported over and.31:00And over, e.g., like secure endpoint secure endpoint raises one alert and your network tool raises another, and the cloud tool raises a 3rd, so.31:18That might involve three people open three tickets and research here and there. So here you you see it's only one case already assembled from multiple sources for you to investigate.31:30Of course I will choose one incident from the list and explain to you in more details. And every incident here, we have the priorities really important the priority score from zero to 1000. A thousand is the.31:46Worst. So priority equals detection risk, 100 times asset value ten. So it's a hundred times ten is a thousand. So the same malware on the domain controller, e.g., is totally different on the meeting room tablet, it's not the same.32:06Name severity, right? So XDR knows what the device is and the least sorts by business impact, not by this. And we also got some filters up here. So filters tend this into a work list instead of a pile, so.32:25There's the date, right, the status and who you have assigned this incident to and about those priorities e.g. if I want to.32:45That filtered event yes so above 900 I've got these others, right? So I just mentioned about the priority score age, a detection risk times the asset value so about the asset value, where is it? So it's under.33:00Their assets. Under assets there's three options about the devices basically telling you what each machine is. So who use it and whether anyone is managing it. The default value is ten. Of course, you can change it. This is the the value.33:20Here this is the demo environment I cannot change it but the 1st thing you do with your own environment you have to decide which one is a ten, which one is a eight because e.g. like servers with really important data that can be a ten, right? So about the users here.33:40This is the source page. Of course, I need to switch to user 1st. The users page will show you the people about who is using the, the devices. E.g., you can integrate with your own.34:00Like Cisco dual, Microsoft Android or other identity sources, you can of course you can integrate telling you the people who use it and about the sources page I just show you. So sources actually shows each product and the last time it sent.34:20Data to Cisco XDR, so that answers a question a lot of products avoid. So you might be asking, is my data still coming in? Yes. If you look at sources page yes, you can get an answer. So a feed that stopped three weeks ago is a hole that you can see, right? And when.34:40I, I want to move to the page about investigate. Investigate page is where you can do some investigation proactively. You can put in any IOC email address domain. E.g., I just put in one domain here and then I.35:00I can do some investigation to search whether any other tools have seen it before. And about the intelligence page here. So intelligence page actually we have four parts, judgments, indicators, events and fees. The judgments here.35:20We're basically telling you whether something is bad. If it's malicious, if it's suspicious, benign or even unknown, so like combined Cisco Talos intelligence sources, even your own intelligence sources and other outside sources. And about indicators, indicators are.35:40The patterns that show up while, while an attack runs, you can build your own private indicator right up here and about the event a single.36:00Sightings showing up here. The fees are least of indicators, so what matters is public against the private. So, which means whatever everyone knows against what only you know, so therefore you can create your own private indicator be.36:14Do your own list of bad addresses, get a link for eight and even .8, the point your file was added so your own intelligence blocking on your, on its own through tools that you already have.36:33And when we move to the automation part, so, the automation part, it looks hard, but you don't have to build these from scratch, right? So, there are rules, there are workflows and even automates and.36:50Atomics and even the system kept the result. So you don't have to build this from scratch under exchange so.37:11Under exchange, we already have hundreds of workflows that we can leverage so you can filter them by who actually wrote them. So Cisco managed here, Cisco managed means Cisco wrote those workflows. You can just one click and get those incidents.37:20And even with Cisco verified. So Cisco verified means Cisco checked someone else.37:40So someone wrote it and Cisco already checked and verified it's working and about community so it means another customer, other customers already shared it with Cisco. So one click it's it's get installed. So here's one I've.37:49Install here, right? So, e.g., like Webex you can send Webex message when a new instant coming in. So I open it. If I open it, it's e.g. here, right? You.38:07You can search, do something, e.g., you can like the usual example like priority over 800 and you want to isolate that machine with secure endpoint, you want to isolate the host. So here's about the whole, workflow.38:22Low and how to install it because this is the so this is show you how to do it and even you want to open a ServiceNow ticket open even you want to notify in your Webex, then of course you want to send message to, to Webex.38:42Webex, you even want to ServiceNow? Yes, you can create PK for that incident. Yes, there are a lot of workflows that you can leverage and back to incidents.39:02We looked at the list, right? So now I will show you a real case. So when I click the name, I get a preview. E.g., I click the name, I get a preview basically about the priority, the status and AI some even generated a summary for me. So this.39:17This one's already closed, I think. Yes, it's already closed. So which products detected I can also get from the sources page. So look at the title, look at the summary already and then I can.39:36Make myself to e.g. like two victim get involved. So that's the 1st hint. This is bigger than one laptop, so that's enough to decide if it's worth my time. Yes, of course it is. So I click on view incident.39:57View incident details. So this is the page I really want to show you. On the left hand side, this is the attack storyboard. On the right so It's showing us about the diagram showing us the assets involved and the relationship between each other.40:16So AI build both we call it instant instant attack verification. So here's what that means. Before I've done anything, it has already decided, e.g. like likely true positive showing up here, medium confidence, it's already.40:34Giving me, in plain English this is a real attack. So think about what that matters, what that saves. The 1st question on any incident is, is this even real? Right? So you you might be wondering, is this even real? The 1st question, right? So.40:55Answering those questions can cause an sock analysis maybe more than 40 min. So here it's already answered with the reasons on the page. Underneath other products detected.41:15This there is analysis and about the containment and even with the reasoning, even with the evidence and we can check on the assets being being involved in this paid.41:29Of course we can see yeah we back to the analysis. So now we can read read the whole story about this analysis. So this is one company, right?41:48It's it's saying async rad campaigns so this is one campaign, not two separate alerts and there are two victims, so two laptops and 1st one is on 26 August, so and then another one.42:03Happened on August of 29th. So Aide was 1st on slate's computer and then on Flynn's computer.42:23Right, so the same attacker attacked twice, the malware is called async rack, it gives the attacker remote control of the laptop because I see there is aC2.42:32Connection. I believe there is a yes, they downloaded the PowerShell from a remote server. So the file actually they use to is a factory.PDF.vps. So it.42:48Looks like a PDF, the real ending is the VPS so it's a script, so Windows has that last part so the user only saw in a PDF file. So when it opened, it started a PowerShell to download. So the PowerShell pulled the malware from.43:07On the attackers server, right? Because the anti virus.43:27Would look at the disk. So it pulled from the server, from the attacker's server and then loaded directly into memory uses legitimate Microsoft services, rack services, which is a real Microsoft program, so it works normal.43:33Then I open the connection back to the to the attacker so it they could send it orders to to the victims. So the same file name, same server, same steps on both machines, that's why this is a real attack. And here's why one campaign really matters.43:53You only saw if you only saw.44:13Slates alert on August the 26th, then you might be cleaning that one laptop and close the ticket, right? Then three days later Flynn's computer opens the same invoice, then seeing it as one campaign tells you.44:17You to look for that invoice in everyone's email inbox to block that server everywhere. So as a SOC analysis, if you've ever written that paragraph by yourself at 11:00 at night out of four councils, then you know what this is worth.44:37Under the story are the actions, the containment chosen by the AI. So out of everything Cisco XDR could do, there are the ones that fit these attacks, so the machine, we want to isolate everything, right? So basically you can select a.44:57A re.45:17Computer, right? You can isolate those machines, of course, and about the reasoning telling you why a why the system thinks this is a real campaign and about the supporting evidence coming up here.45:20So about even about the assets here, so you can get more details on those.45:39Assets. If you want to read more details, you can just click click up here and moving to the detection. So instead of reading multiple lines, a hundred lines associated already grouped into detection groups for you to read, so not too much.45:47If you want to get anything further in details of course a everywhere you can click on and the attack being used and the observable is showing up here about a PowerShell, downloaded. So of course you can check up here about the response Response is where we it really.46:06Matters because we want to find the attack. We want to contain the attack, right? So this is really important about the containment, even we want to eradicate the incident, and at last we want to get everything recovered, right? Even under workload.46:26Yeah, anything the AI analysis even you can add some note by the SOC analysis then you can get everything reported here. Of course, under report you can.46:46Get everything exported to your leadership team. So this is about the same architection. Also, we got a picture right up here. So some people would rather read it. Some would rather see it. Every box here is a real thing. So every line between them is.47:00Something we actually saw. So the user about the PowerShell, the process, even the user, the user, right? Even about the the the server, the remote server. So everything that you can click on, you can even deep dive on. You can, e.g., you click on it will show.47:19You the details about that process, the, the process. So.47:39Each box is a real thing, so I will click a program e.g. this one. I'll get it's named and show you what it has done. So everything about it is, is showing you about the relationship.47:45So let me pull it together. We started on one dashboard. It told us what was happening without opening six councils then a map that showed us what we could actually what we could actually catch, right? And what we missed. So.48:00So about one incident here. I I already showed you about the incidents, so the hard work was already done. It told us the attack was real, Low down what happened, Low down what really happened, and we can dig dig more.48:20The deep dive more into each of these incident, right? So it really helps us understand what happened in plain sentences showed us why and left approved underneath, and we saw even workflows that do the repetitive work here.48:40So a search that asks every tool at once. So here, right? We've already got some workflows showing up here, even we got them we can do some investigation like proactively on demand accounting. So here's the part.49:00So I I'd really to want you to remember about anything. If anything happen in your environment, you can check on my environment only. So it will show you whether you have seen it in your own environment. So, it's really matters. So what changes.49:20What changes is this instead of three separate tickets so you you get one ticket coming up here. So we find it, we understand it, we stop it in one place. This is about Cisco XDR. Happy to take any questions.49:40Okay, ok, so that was the demo for Cisco XDR. I'm happy to take any questions. If you have any questions, please feel free to to pop in to the chat box, even in our QA map panel.49:57Hey, thanks. Thanks Mary for the detailed walkthrough. I personally enjoy it a lot. I hope the audiences enjoy it as well. I think we have answered majority of questions. But before we close, there's a few resources to help you keep going with Cisco XDR, the community forum, if there's any question.50:19Even after this session, feel free to ask in the community space. I think there will be an expert like us to help answer the question as well.50:39There's also hands on training, product documentation and the integration catalog, which already shared in the chat, so feel free to assess them. Yeah, if that's the case or if I think before you go, a very short survey will open up when you guys exceed.50:49It takes 2 min or less, we read every response and ship what we cover in the whole Cisco expert insights session. So Mary and I appreciate all feedback, including what worked well. It keep us motivated to run session like this. So we hope to see you at the next session, so.51:08Just keep a lookup and register accordingly. So with that, I'll give you back 8 min of our time. Thanks everyone. Thanks for your time.51:28