Operationalizing Cisco XDR: Hands on integrations and incident management

Oh, good morning, everyone. Thank you so much for coming to the security operations with Cisco XDR. We will, we have both.00:00Well.00:20Presenting this morning and Oksana and Audi answering questions on the side. If you have any questions, please feel free to drop it into the Q and A section and we will get to those during today's session. At the end, there maybe time for live question and answers and all if all questions will be sent out with the recording.00:21After the session. So Bell I'm going to hand it off to you.00:41Excellent. Thank you Laura. I'm excited to be here. Just a quick introduction. I'm the technical product manager for Cisco XDR in our Splunk security org. With me I have my esteemed colleague, Addy Sankar and our team leader, Sana, so they will be going through any questions.00:45That you have in the chat that it may not see, and they maybe joining in with with some nuggets of wisdom throughout the presentation. So today we're gonna be talking about security operations with Cisco XDR. The real focus will be how everything connects together.01:05And how it's done, how the alerts become incidents and how the context comes together.01:25So, let's get into the agenda. This presentation, I have a lot of slides to go through, so apologies if I go quickly, but I want to make this demo heavy. We'll actually be going through, four demos. Most of our time will be spent in the demos.01:31I'll briefly talk about why XDR, how the industry has evolved and where XDR fits in. We'll then talk about identity. We'll talk about CII with XDR. The next demo will be on Splunk. As you know.01:51Who acquired Splunk a few years ago.02:11And Splunk is Cisco Cisco is Splunk. We'll talk about how these tools overlap and how they work together and how really the best outcome is when you have XDR with Splunk. We'll then talk about Meraki, MX with XDR.02:13This is a key integration that we've introduced and we'll speak about how this really resonates with a lot of customers and especially customers that have, you know, lean network operations teams, we're bringing the network operations and.02:31Security operations closer together. We'll talk more about that integration and how that and how that's configured and works together. We'll finally close with what we're seeing in the real world, at global events socks such as black Hat RSA conference, which you.02:51May or may not be aware, we actually deploy XDR and SOC and manage XDR and Splunk, excuse me, and manage the full security operations for a lot of these major flagship events.03:11So let's get right into it. XDR, it's the industry for a while was focused on EDR endpoint detection and response. Cisco, as you know, we added a domain expertise from the network side. So while.03:27DR has been foundational bringing the network as a sensor is a real value add that Cisco brought together to have XDR. And sophisticated types of attacks require.03:47Telemetry beyond just the endpoint, right? The NDR brings in the north south, east west traffic in your real time. We're looking at what happened not just during the exploitation on a single endpoint, but we look at the timeline.04:06Where endpoint is just one layer in the timeline. We're looking at pre exploitation activity, we're looking at post exploitation activity, lateral movement, and the full picture is, is what we need, right? So we're bringing in that additional network telemetry for a complete picture.04:27Now, with, with that, you can see here that this this diagram it captures the data flow. So our data warehouse, is.04:47It is capturing all of this telemetry, transforming it into OCSF, where we're doing forensics, where we're doing analytics 3030 day baselining on the activity and detection findings that are coming in.05:03We're bringing in, the 3rd party detections as well. So one of the values of XDR is we have an open ecosystem, and together we are also bringing in threat intelligence from Talos as well as.05:21From other providers enriching that and the latest, the latest releases of XDR have also brought in LLM based summarization AI to really have a, a holistic view for the analyst where they can get a full picture of what's happening.05:38So as I go into the 1st demo, I want you to really take in this point that identity has become the attack surface, right? Identity is a new perimeter in that with the rise of unmanaged identities.06:03BYOD as well as with agent based identities. It's more and more important for us to have that identity based context in our incident analysis and response. And.06:1960 % of breaches today leveraged identity as a key component. This is in our last year's surveys from Cisco Talos. And over here you can see we are bringing in a number of sources, right? The idea here is the value is correlation.06:38Right, the values correlation is bringing in identity together to take decisive action. And this is a, this is a screenshot from our.06:58CII, where you can see that we are bringing in a number of identity providers, we are facilitating the notification and response based on the checks, the identity checks that are being done.07:16And we're leveraging APIs to connect everything together. Over here, I'm not going to go in detail through this slide, but it shows you the different identity sources and how we, we get the data in. In some of these cases we're getting full event streams.07:32Right, which is as real time as as you can get and and most of the others we're also getting REST API full sync, and in some cases it's a delta sync. So what are checks, right? Analytic basically there are analytics detection rules such as.07:51You know MFA login failed, user password expiration and and so on.08:12Oh. And we're also checking for things like compatibility, right? And, and, and we're mapping that to the common frameworks. You can see that we have.08:19Most of the industry frameworks listed here, including CIS, MITRE and CMMC. And the check settings are configured and can be tuned based on your environment, based on what you consider.08:34Risky behavior, right? And it's very easy to set up, very easy with a few toggles, that you can customize this to filter out things that are noisy. And you can see here that it these are just simple toggles, very out of the box and turnkey.08:53And you can add exclusions and and whitelisting to filter out points. So a great announcement that we had recently is that XDR essentials now includes identity services.09:17Reason for that is strategically we consider identity to be foundational, right? It's NO longer an optional, you know, value add. It is it is foundational and it is essential. Therefore, XDR includes CII, right? As as a headless app.09:33For enrichment and bringing that in. And we're using security cloud control. We're bringing in a lot of the consoles into SCC, which I will show you shortly as I get into the demo for CII. But the idea here is in the past.09:55Cisco loves having, as you know, different consoles, different tools, but we are bringing more and more into unifying that and bringing that in into SCC.10:14For ease of use, ease of administration, and consistency consistent look consistent feel and ease of management. All right? The integration is quite simple.10:25As well. It is three clicks under 30 s fully rest based. So what that means is you're not deploying you know you're not deploying an appliance, you're not deploying additional hardware. This is cloud to cloud, right? It's cloud to cloud. It comes with your subscription of XDR.10:42And there's three kinds of APIs that you can use, right? Namely the admin API, off API, and the streaming API that I spoke about, right? Based on, based on the provider, of course.11:03MS entry ID is one of the integrations that that is that is key, a lot of our customers are using and all the integration it goes through the Azure app registration. So this is a screenshot here of how you can configure as you can see Cisco XDR.11:23Into, through, Azure. The app is given the explicit permissions so that you have fine grained control in terms of what is being sent and, and, and the data that's being ingested.11:41MS Central basically copies the directory data using Microsoft's graph API and CII, it requires specific permissions that you need to enable. And what this will do is it'll set up event streaming.12:01And event streaming, as I mentioned, it is the most real time experience. One call out that I should say is that if you're going to enable event streaming for MS central, this does require a subscription, right? It requires partition potentially additional costs.12:16So that's something you need to consider. And you can see that the settings can be set up here with your app ID and the directory ID.12:35And here you add the event hub that you created in Azure to stream the events to CII and you can set up the the interval, which test 15 min. You have a detailed list of data types that you can activate based on the the check boxes here.12:53And basically, we're leveraging webhooks, right? A webhook is a simple event driven callback between systems. In this workflow, CII sees a failed check and sends a small HTTP payload to XDR.13:17XDR automation receives it, parses it, and maps it into a detection finding. I'm gonna show you what this looks like and sends it to XDR analytics. Side call out, one of the values of XDR is it has a built in.13:33Low, NO code soare, right? Which a lot of other providers they charge for, but again, that's something we can consider foundational, right? Is the, not just the detection but the response capability in XDR.13:49So identity becomes an important XDR signal. So, now let's get into my favorite part. Let's get into our 1st demo. We're gonna show how you can add a CI module.14:04Import CII workflow and what that looks like as an XDR incident. So let's get right into it. Over here, I'm logged into security cloud control and I can go here in identity intelligence.14:21Integrations, and sometimes this takes a hot minute. Let me just log in directly.14:39Okay, we'll we'll come back to this SCC page, but.14:58I can show you directly in the console here and what you see here is in my environment, I've configured MS intra and traceable actions, right? And both of these, sorry MS MS intra and dual, right? And these are.15:08Basically going to, these are web hooks, right? That are tied to check failures so that when a CII check fails, CII can send that event to XDR, right? These are the notification targets here for the web hooks. And if I click here.15:28You can see I clicked add integration. You can see the list of providers that we have available, for identity, right? Your your CII data, it might be leveraging multiple providers, and that's what we've seen in, in customer environments, right?15:47It's not always a case that you're just getting data from AWS, e.g..16:07Or from Active directory. So the point is simple, right? Identity data usually lives in a lot of different places and CII brings that together. We have a number of integrations here, including of course dual, we have Okta, we have some interesting ones, like you can see Salesforce here.16:12For our workflows, which I will show you as well, throughout this presentation, once you get based on the check response that we get from our webhooks or feeling users, we can send notifications.16:32Such as email or through your preferred collaboration messaging, tools such as Webex Slack to an S3 bucket. We also integrate with the common ticketing providers, namely Jira and ServiceNow.16:47And you can see we even have API, based integration. So it's very, very flexible. That's the bottom line, right? So now I want to show you an XDR what this looks like. So I'm just logging into to my.17:03My XDR console here. And I want to show you, in the exchange, I'm gonna search for CII, and you can see that there is a module ready to go here.17:23Right, and you can, it leverages the following targets and it's basically a few clicks and you're off to the races, right? It's part of your subscription, and you can leverage this this workflow.17:42So now I want to show you in the workflows what this actually looks like. So this is again, it's part of our exchange over here what you're seeing.18:00As you're seeing the CIA custom security event, ingestion workflow, which leverages our, our soar, our our low, NO code soare, and we're getting the, the webhook data.18:19Right Running some tests to see if we're able to handle errors, parse the data, right? We are, we're parsing the data, grabbing key information such as IP, and based on the value and the analysis.18:36We push that data to XDR analytics, right? So that's what's that's what's going on behind the hood. If this is overwhelming, don't worry, this is, I just wanted to show you behind the scenes what the logic looks like, but.18:53XR, we've set it up to be very much out of the box and and turnkey, so you can just import this automation workflow for a custom custom ingestion. Now, I want to show you.19:11In in XDR investigate, we can see some of the detection findings. So I can go here and detection findings. I'm filtering by last year here.19:28And source as you can see we have a number of sources, a custom security event, right? So a lot of these events you can see they are coming from CII such as MFA flood.19:44Right, and is bringing those findings in. The value of XDR, again, is we could be we're getting, and you can see we're getting a lot of these events. Some of them are related, some of them are not. XDR is doing the correlation.20:00Behind the scenes to bring that into the relevant incidents and to escalate to the user, to the analyst what is what is pertinent, right? And the outcome is.20:18And actually our incident, right? With enriched identity data. In this case we have this untrusted user alert for this asset Emerald, we have an AI based summary, and we have a nice visual graph where we can dive into the email data that's coming in.20:35Okay.20:54We can see the affected users, all of that we can, we can dive into in, in much more details, right? So that's kind of the end to end stop sharing. Let me share again of CII and how we're bringing that in. I'm gonna move right along.20:55Here, to just make this full screen. All right, so that was demo one where we saw how you can add a CI module, right? It's very easy. It's done through the UI and there's.21:15No additional appliance or hardware required. We can import the CII workflow from the exchange to get custom identity events, and we can see that those, you know, those detection findings, how they correlate into an XDR incident.21:36Next, I want to talk about, I want to talk about Splunk, right? How does this, how does Cisco and Splunk work together? Well, usually when, you know, people think of a lot of customers have this question. They think of Splunk, they think of XDR.21:57There are some, you know, there, there are some overlapping features, but they serve different purposes, right? XDR is turnkey. It's, it brings immediate security outcomes, whereas Splunk.22:17You can do, you know, it's, it's, it's different data models, right? You can do longer analysis, threat hunting, you may have compliance needs where, where Splunk comes in. In this case, let's talk about the Cisco security cloud app. So this is available on Splunk base and.22:34What this, this does is it's one app that manages multiple security inputs. The app is modular.22:53Right? You can get it from one place, Teams can configure inputs, products like dual, secure access, secure firewall and multi cloud defense CII, and XDR. And each input gets consistent set up guidance and dashboards, right?23:02The dashboards give the analyst a consistent look and feel, right? And that makes the operational side easier. It's fewer one off apps and a more consistent way to manage the dashboard. XDR data can show up where Splunk.23:21Analyst work. So again, we want to make the, and we have made the integration very seamless between XDR and Splunk. XDR handles correlation and prioritization, whereas Splunk keeps the soft software flow and reporting model.23:40We also make the integration health visible in Splunk, right? Data pipelines do fail. Api's can get throttled throttled and permissions can change. The app is what gives the health and performance view for throughput, volume, connection health, and more.24:00Data integrity is what keeps the pipeline honest, right? As you know, Splunk data ingest is very important, right? So it's not the flashiest part, but it is critical. I know a lot of customers have asked me, ok, about, you know, monitoring the data ingests making sure that.24:19That things are working correctly.24:39And XDR incidents can become Splunk ES findings, right? Which will show, which I'll show in my 4th demo. So let's get into, let's get into this a little bit and see behind the hood what this looks like.24:44Alright, so right now I'm logged into, into my Splunk cloud here and you can see I am in Cisco Security Cloud app and over here you can see all of the Cisco products that we have.25:10Available as part of this cloud app, and it really, as I mentioned, it makes the management of your, of, of your Cisco suite very easy in Splunk, right? It's a, it's one app, it's modular, and it's available on Splunk base.25:31Yeah, you can see the inputs here, right? That we have. And as I mentioned, we have multiple out of the box dashboards. I'm just gonna click on the secure firewall one here.25:48And we can see the takes a hot minute, we can see the analysis and insights that are highly relevant to the SOC and we can filter by the event details.26:04Likewise, you can go to, e.g., XDR, and you can see what, what incidents are coming by priority score and other insights that are relevant to the SOC team and the SOC manager.26:20So that's one direction, right?26:41That's XDR into Splunk. Now I want to show you, and now I want to show you the other way around. So let's go into XDR.26:43And I'm showing you right now in the automation exchange. This is a simple workflow that I've set up for purposes of explanation on how we're getting custom security events into, into XDR.27:03From Splunk. So there there's really three phases. We get the data in where we're running a Splunk search. You can see here if I click on this, this is the search that we're running. You can actually run this on the Splunk in the Plunk cloud. And this is valid SVL.27:22We're then parsing the data, getting info important information from the JSON, including the source port, destination port, the message and so on. And then that data is being ingested.27:41Into XDR, right? That data is being ingested into XDR and I can show you what that looks like in the detection findings.27:56Right, so we can see all of the detection findings that are coming in and, and investigate. Actually 1st I want to show you, this as well.28:29The, on the integration side, we can search for, we can look at my current integrations and I can click on this e.g. TME. So I just want to take a step back because I think it can get a little confusing. What I.28:43I showed you 1st was data coming in as custom security events, right? So this is useful.29:02For when you want to bring detection findings from Splunk, events, incidents from Splunk into into XDR, right? So you have a, a security finding in, in Splunk that you want to from enterprise security maybe you want to bring it into XDR, you would use that custom.29:10To that custom workflow, right? From our exchange. And in this case, this is bringing in enrichment data, right? So there's there's a difference. One is bringing in events and and one is bringing in enrichment data. And, this.29:31The Enrichment data is configured through the administration integrations page. In this case, all you need is an API token, from your Splunk and you can select the same data models that you want to bring in as enrichment context, right? In this case, I'm bringing in network graphic.29:47Malware DLP and intrusion detection. What this looks like is if I go to investigate and I've saved this investigation, I'm just searching a simple IP eight.eight.eight Google DNS.30:05And filtering for my environment and you can see one of the sources is coming from Splunk Cloud, right? I'm getting this Palo Alto networks, data being ingested, right? You can see this Berk collaborator.30:22Information that's being coming in into the investigation here. Alright, so the, so that's really the, that's really what I wanted to show you for the Splunk.30:40The Splunk demo. It's basically it can be configured both ways, right? Actually there's one more thing I did want to show before I move on. So if I go to detection findings here, you can see, I'm just gonna search for.31:01SFW, so this is from Cisco Secure Firewall, and these detection findings are coming in through the custom event workflow, right? That that we would import from our exchange.31:20So in this case, we're seeing malware, CNC DNS fast flux. This is coming in from Splunk, right? So that was, that was a lot that I had shown here. I'm just gonna recap what we saw.31:36Right? We've started by looking at the Splunk Cloud app, right? The Splunk Cloud app available on Splunk base, which is the one stop shop, provides consistent look, feel, and management for bringing in your Cisco data sources.31:53Right, we looked at how that brought in dashboards, how that brought in details from XDR. We then looked at how you can bring in custom security events using workflows in the automation exchange using XDRs built in SOAR.32:11Right, you can import that workflow and you can start bringing in custom events from Splunk into XDR. We we looked at how you can separately bring in enrichment data from Splunk and that's even easier, right? You go to the integrations page.32:30And you provide your API key and you can bring in those same data models.32:50We looked at in the investigate what that enrichment data looks like, right? When you search a simple IP, such as eight.eight.eight. And then finally we looked at the outcome of that, bringing in that workflow where you can look at detection findings and get.32:54Custom detections from Splunk in XDR. We're gonna come back to this in my 4th demo where I will show how, the analysts work across tier one, tier two, tier three to leverage XDR.33:12As the turnkey solution, as the tier one analysis and and Splunk for higher level analysis in a very mature sock environment. So now I want to get into the 3rd topic for today's webinar.33:32Which is Cisco XDR with Meraki.33:52Meraki brings network teams into the XDR story, right? The advantages of the Meraki integration with XDR is network telemetry is foundational to XDR. It's always been foundational to how we've built Cisco XDR. And.33:56And we're now able to leverage Meraki MX devices as sensors to bring in that wealth of telemetry, that wealth of data that's coming in into your network and turn that into security outcome.34:15This is really valuable for lead teams, right? We call it snock, security operation center within a network operation center. In this case, we're bringing in.34:33And it's a two way integration, right? We're bringing in MX devices. We're turning them into sensors and also the MDM, which is legacy, sorry, not legacy, which is end of life. But the focus is we're bringing in both of these particularly the MX devices.34:47And the integration is cloud to cloud, right? So this is something that when I speak to network admins, when I speak to not teams, they really love this. They don't have to deploy any additional.35:13Agent hardware detailed configuration. You use your existing Meraki stack. The data is bidirectional using OAuth, and basically the MX networks send contextual NetFlow directly to the cloud and XDR uses that tunnel.35:27For analytics, anomaly detection, behavioral detection, and incident correlation. There is absolutely NO endpoint agent to deploy for this part. That's one thing I want to be very clear, and this is something customers really, really love.35:48Great. The customers select the eligible networks that they want to send data and the flow just starts. It starts contributing to XDR, right? So let's have a look. Let's have a look. We're gonna look at how you can configure the.36:02XDR Meraki integration from the Meraki portal. We're going to look at an XDR incident, what that looks like based on Meraki telemetry, and we're we'll look at also how you can do response actions across your network, such as a.36:22Block an L three block on your Meraki devices using XDRs built in SOAR. So let's dive into that alright.36:40So right now I'm on the Meraki dashboard and I'm going to click on Organization integrations, and you can see I have a number of integrations connected for my particular org, but let's look at XDR.37:09And I'm not gonna disconnect this, but I could, you know, disconnect this and set this up in few clicks, 30 s, and really all I need is my attendant information and and to set this up I need to configure the networks that I want to send the netflows.37:25You can see I'm sending from a few of these here, and this one is disabled. So each MX device becomes a sensor. It's that simple. It's really that simple. It's a cloud to cloud connection, right? Between the Meraki org and the XDR tenant.37:45Because this is a live webinar I'm not gonna disconnect our our prod instance, but the flow is simple. You can see that. And now let's look at what this looks like on.38:03The side here. We have a, you can go to organization security center and you can see the XDR incidents. So this is another view that.38:18The network admin teams, the soft teams, they love this. This is replicating exactly what you're seeing on the XPR side. You see it right here. You can see all of your incidents coming in, right? You can assign them.38:33I can assign them to, to the team members, you can change the status, you can view the details, right?38:50Has a title here, the, the breakdown, the AI based prioritized breakdown, we have the description, we can look into what assets are affected and the relevant observables. And if I then deem this to be.39:05A false positive, I close it right here. I don't even need to go to XDR or I can assign it and investigate it more deeply into XDR. And this is an example incident. So we see this suspected port of use.39:21It's Map to mitre. I can dive in visually and, and, and see all of that details here, right? And if I go here, I can filter by the data that's coming in, the detections I should say that are coming in from.39:39The meraki side. And I can also do the full response across identify contain, eradicate, and recovery. And these are pre loaded.39:57Playbooks I can also customize them, but really the XDR makes it so that you have a, a very turnkey experience, right? So, e.g., if I want to execute this, I can block.40:13The relevant IPs that are considered malicious can hit execute and you can see this automation workflow is is running here. And I can view the run details right now it's running, but once it completes I can see the result, and I can verify that a firewall rule was indeed created on my.40:29Meraki MX device to block this. So, very neat and Meraki customers with Meraki environments are using this. They're adopting this at high rates we're seeing.40:50So, so yeah, what we saw in this demo in in the in 2nd demo, in the 3rd demo I should say, is we saw how easy it is to configure Meraki integration from the meraki portal.41:06It's, you select your tenant, and the networks that you want, the MX devices that you want to send NetFlow data from, and within 30 s, those MX devices become.41:25Sensors. They become sensors for XDR and that NetFlow data is flowing to XDR. We saw the XDR incident that you could see the incidents.41:41In Meraki, it is a true two way integration. You see the data in Meraki, you see the data in FCR. Meraki what I didn't show is also sending the, you know, the network identification, the all of the details that.41:55The mapping, right? The, the ID, all of that is being replicated in XDR, so it's very easy basically for a network admin to understand and connect this incident is relevant to these devices in my Meraki network.42:13We also saw that you ma you can manage the full response using XDRs built in SOAR with a few clicks, you can block and contain threats, e.g., across your Meraki network devices.42:30So again, this is something that's that lean teams networking on snock teams is the term that we've coined love this, this use case. So finally.42:48I want to talk about how we're deploying this solution on all of this technology in the real world. As I mentioned, we're supporting SOC life SOC events across the globe, including, this is actually from black hat. The picture you see that's that's myself.43:04That's my esteemed colleague Addy in the background, but basically the idea here is we are, we are trusted by black hat by RSA conference of course by by Cisco live, which I'll be at to deploy XDR and Splunk together.43:24And rapidly.43:44And make it work, right? And we're using Cisco Security Cloud and, and, and these solutions. We work with 3rd parties as well, so it's not the case that it's just Cisco at some of these events such as actually such as blackhat. We're working with Palo Alto, we're working with.43:46Our competitors. XDR is an open ecosystem, right? So we, we can meet the customer.44:06We can meet, you know, where they are, basically. And these are some examples of really global flagship events that we've supported. We continue to support our supporting the super Bowl, myself, my colleague was supporting the Olympics. We'll be will.44:13Have a full running socket cisco live. If you're there, come check it out. And, and each of these are are different, right? You can see there there's different technologies mentioned. So it's customizable, it's expandable. This is our sock in a box hardware, rapid deployment.44:33You can see the cables on the right are intentionally we took it before we cleaned it up, because we do rapid deployment. XDR, it's set up in a few hours. The these socks, this sock in a box is set up in.44:53About 3 h, my colleague, Addy actually leads the SOC events and he can tell you definitely about all these components. This is what the architecture looks like in terms of a data flow. We're using end dates for.45:11Full PCAP we're using Cisco firewall, secure endpoint, all that is coming into XDR and we have an integration with Splunk, right? Which I'll, which I'll show you.45:27The way that we handle it is the tier one tier two analysis is done in in XDR because XDR presents a very visual view. It presents a very visual view, it's very turnkey.45:43Easy to get trained up, easy to understand. The findings that we find are, are true positives are worth investigating. We have an automation workflow to escalate those findings to Splunk ES.46:00Right, where the threat hunters do more detailed threat hunting, analysis across logs across their sources and respond to the incidents. Some examples you can check out of links of log posts, this is.46:15Malware, which we investigated, you can see the XDR view here, the different sources coming in. Bottom line is that the infected endpoint we were able to respond to it and get it off the network.46:35And let's get into the demo. All right, so I want to show you now in the life of an analyst what, what some of this looks like. So this is actually from our, this from my Webex. I've hidden, I've hidden the messages here.46:51But this is from RSA conference, right? Where we're looking at.47:12An example incident here. This came into our shared space and basically you can open the XDR incident. Let me change the value, the org to the correct org, because.47:18I am fortunately or unfortunately a member of many different orgs. So let me go into this and show you what this incident looks like, right? You can see there's a nice visual graph here where we can go through.47:38What's going on? We can dive into these malicious artifacts here. And basically what happened was that the analyst, they looked at.47:57They looked at this and they concluded that, hey, this is a true positive, this is a true positive task, and what they do is they execute, they basically change.48:12The, the status of, of this incident to, if I go to open reported and that triggers a workflow that we saw, we saw the automation, the soar capability in a.48:29For the demos, but that basically triggers a workflow.48:49To once the status changes for this incident to send this over to Splunk, right? And that's what we see in the next message that the tier one analyst said this is worth investigating, right? And then it was.48:53Escalated. Let's look at what this looks like on the Splunk side. Right, so you can see that all the work log notes from XDR were forwarded to Splunk.49:11You can see the details are now available in Splunk and and and then the tier three analysts, the hunters, they can do further investigation and correlation across Splunk, right? So that's really the value in a very high profile.49:26Mature environment. This is one use case of course with XDR and Splunk ES. Another common use case that we see is XDR with Splunk core, right? Where you're using Splunk for longer data retention for compliance needs.49:45But, I wanted to show you this view as well. So depending on where you are in your maturity journey, XDR and Splunk provide that holistic threat detection and response platform that you need. And.50:03We can set it up and tune it up per the maturity of the organization. The last thing I want to mention is, is this white paper, right? If you're interested in, you know, in reading at length.50:20Then my my team has written written the book on on this where you can go through the full stock in the box architecture, and see how, you know, how XR and Splunk can.50:36It can't it can can facilitate that maturity journey for threat detection response. So with that, with that, I'd I'd like to bring a full circle and just recap what it is that.50:55We saw today, right? It was a lot of demos, less slides, which was my intention, right? I wanted to show you four different scenarios. One is CII, right? Cisco considers identity to be the new perimeter.51:13Right, CII is foundational is part of your XDR entitlement. It comes in as a headless app and it's an open ecosystem. We sub we support we we support a wealth of IDPs.51:31We saw how you can bring in that identity context for your incidents. We then looked at Splunk Enterprise and XDR, how you can configure data to come from XDR to Splunk using the Splunk Cloud app and how you can configure.51:47Splunk data to XDR either as enrichment using the integration, the built in integration or you can even bring in custom events using the workflows that we have.52:06We also saw Meraki, we, we saw the Meraki and XDR two way integration where security and network operations team, security and network operations centers teams, I should say, are getting a lot of value, right? Lean networking teams lean.52:22The IT ops.52:42Are bringing in or are leveraging their existing network stack to up level and get security outcomes. We then looked at, you know, large scale events and how we do incident management, right? How we do incident management, how we use the tool.52:44Tools together at global SOC events, at the largest sock events like black Hat RSA conference, where there is malicious activity and we are trusted as the providers to facilitate that.53:04So with that, I want to conclude my presentation, and open the floor for any questions that we've not addressed. I wanna, bring on my my panelists here, Oksana who leaves the team and and Addy to.53:18Chime in as well if I've missed anything or if they'd like to add anything to to what I've said here was a question in chat that says, do we have an exact timeline for the native integration between Cisco XDR and CII?53:37Yeah, I'll let I'll let Addy and Oksana chime in on that one. So, for detection ingestion, I suppose like for user risk detections, that's currently being worked on.53:56We're currently doing discovery in this quarter, but we I mean, the closest timeline we can tell you is in three to six months. Hopefully it will be sooner than that.54:14But again, that's that's being worked on, right? We have released the custom ingestion capability right now, which was the most like the the largest engineering lift and hopefully the incremental work that's necessary to make it a native detection cap.54:33The ability will follow.54:53There was also a question about the console for CII and XDR and I mean unless I'll let you to chime in but on this one, what I wanted to say is with the ability to ingest CII detection into XDR.54:58PR is definitely your main tool for looking at like for threat visibility perspective from configuration perspective and and defining those identity policies, managing those configurations and looking at the raw logs that you're getting that would be CII.55:17So that would be a combination on both depending on the goal, the outcome. The recording I believe will be provided correct, it will go out after the session.55:38With all, with all links and materials discussed during the during the presentation. So there is a question, does your advantage tier include events streaming from CII?55:55I honestly don't remember, Addy, do you remember? Yeah, that's a Microsoft add on, so that event streaming is part of like Microsoft security hub. You can pay additional and get the like user event streaming into CII. It basically makes the the.56:10Checks or the the detections fire faster, right? Because otherwise you're doing like a sync, like a daily sync on the user data and pulling it in, you know, on like a polling basis. If you, if you pay extra and do the Microsoft there's a microsoft adam, by the way, not a Cisco add on, if you pay extra and do the Microsoft add on, then you're like pushing the.56:30Data into CII versus waiting for the CII to pull and then pull the data in.56:50That's what that was about and are there any final questions? Take that as in.56:55No, and everybody.57:15Below, Oksana, Adi, thank you so much for being on today, being our panelists and our very esteemed presenter. Folks, as we wrap this up today, we will be sending out the recording of today's session for future review. Additionally, any and all resources will be sent out.57:18It will be included in a follow up email, so if you missed any of the links, you'll be able to access them and review them when you receive the post webinar email. And if you have any further questions, we have about another second and then we will close out for the day.57:36All right. I'm gonna take silence as that is all. Thank you again everybody for attending today. Please keep an eye out for the post session email with all of the resources that we discussed today and I hope you have a wonderful rest of your Wednesday.57:59