Reviewing the final milestones for the SCA Convergence into XDR - APJC

Hey everyone, thank you very much for jumping on and joining us today.00:11We will be reviewing the secure cloud analytics to XDR convergence and what that means. I'm going to start by sharing my screen so you guys can see what I'm looking at. Here we go.00:16So as part of today's webinar, there are a few things we do want to cover, we want to cover what the final convergence means, the architecture and US UX mapping, some completed capabilities we've already done, and we will show you that live towards the end of the demo or the webinar.00:31The progress checklist and what you can do to make sure you're prepared and then open her up to any questions or that you might have. So to start, Cisco XDR is going to become the sole operating experience for.00:47Our customers and for yourselves. You know, in responding to customer and partner feedback, the original deprecation date for secure cloud analytics was 24 October. It is currently set and have been pushed back tentatively.01:07To 7 December of 2026th once that hits the expectation is the secure cloud analytics experience user experience will NO longer be available. So the SCA portals themselves and that secondary UI.01:25Will not be accessible, you won't be able to log into it and you won't need to manage it anymore. With that, we did have a SCA to XDR transition program that has recently closed, closed on 30 September right at the end of the month.01:41If you have an entitlement, if you're an SE only customer, you're still on your original billing leader, you're finishing out your existing contract, and you do want to clean your entitlement then the recommendation now is to open up a tech case. We will work with them to validate and verify your order, make sure it is an active.01:58SDA contract, and from there take the steps needed to make sure that you are enabled and can provision your own XDR tenant and utilize it and make sure that all of your migration is going as smoothly as possible. So the big questions we receive from.02:18Customers internally externally, you know, what's changing and what's staying the same.02:38With Cisco XDR. So the big thing is the daily UX. We NO longer need to manage then both UIs from the XDR and SCA sides. It will solely be in the XDR user experience once that application date hits.02:43Detections, incidents, investigations, asset contexts, workflows, all in the XDR UI. Your telemetry, so your existing network, you know, onas, your cloud log ingestion, those all will remain functional.03:01We do ask that you do not feel the need to redeploy. Our goal for this migration is to make it as as easy and seamless seamless as possible for our existing customers so that you don't have to go and reconfigure a bunch of stuff and, you know, pull a bunch of levers when you've already had stuff set up for years.03:16We really just want to be able to take what you have migrated over as best we can and not have you have to worry about anything changing or or breaking along the lines. One thing that does change.03:34And something that we do recommend you pay attention to are the webhooks. So the webhooks more specifically around notifications exports, any downstream automation that you might have like your alerts or your sensor down.03:50Those, we do ask that you recreate in XDR as workflows. It's one thing we couldn't do on your behalf and it's something we feel more comfortable having customers do on their end because it might be that, you know, as you get used to XDR.04:06You may realize you want to change things up a little bit and you might not need a notification alert or email every time you get an alert you know things along those lines, so that is probably the one key thing here is make sure that your webhooks.04:24Are turned into workflows in XDR itself. So as we continue to jump in, what does this mean for SCA and XDR today and how does our.04:39Detection engine evolved. So as most of you know, if you if you've been playing around with the product, SCA is the engine behind the car, right, inside the car, right? It does the correlation, it looks at all of your data, you've got all of the ton of information there.04:54Done set up, so e.g. your netflows, your cloud logs, your NVM data, right? Those are all turned into observations and then those observations are turned into alerts. In XDR, you still have your netflow, your cloud logs, your NBM.05:13But we add a OCSF activities layer as our normalization layer, in between that telemetry and what we call a detection, which is, you know, almost an equivalent to an alert. So those detections then become, you know, also OCF findings.05:31And then those findings are correlated into incidents. Again, if you've been using the product, not a whole lot of change from how it behaves today. The key is just you'll be able to do everything in.05:50One stop versus multiple. As we continue down, SCA becomes, you know, that focus capability in XDR. So your alerts observations, event viewer.06:07Your device context, again, the webhooks, exports, NVM, cloud logs, that does move over. And as you can see here on the right side of the graph, right, it becomes part of the actual user experience. It's something that we have been touting and trying to do for.06:25Two plus years and are making significant headway on, hence the, you know, the deadlines for 7 December with the original of 24 October. We're also going to be expanding these capabilities as part of XDR.06:44So you're gonna get it all in a nice one stop shop. Some of the things that will change, and one of our biggest questions that we've gotten recently is, well, what about our watch lists?07:03The watch lists themselves aren't necessarily changing, it's the behavior and the logic behind them that will be changing. And I'm not a person or a big fan of kind of reading screens and.07:19Sentences because you guys can read for yourselves but essentially the behavior behind the watch list is what's gonna change slightly less alerts you know from what you are getting to what is going to be coming and then just the way they behave.07:35In general, so you may see that, you know, some more rules fire you know based off of that little hidden logic where you're now just getting the one alert versus three alerts, you may see that, you know, some don't fire because that logic is behaving differently now.07:52Right, it's looking at it from a holistic context versus just the little bits and pieces that we got from the secure cloud analytics side and you know, it's just something that we wanted to make customers aware of, so it's not like we're getting rid of it.08:08Where it's going away. It's just how it functions is going to be the key changes in XDR. These next few slides, we're gonna review the timelines. So the timelines.08:24Are grouped and we tried to group them so that it kind of all falls with the same within the same story. This to start is kind of what we've done. To be clear, secure cloud analytics itself as a product has been end of sale since November of 2021st.08:40No 13th of 2023, but it was not end of life and it was not end of life for a reason because it is absorbed, it was absorbed by XDR at that time. Why since that time we've always said.08:59It's not a standalone product, it is part of XDR. It's also when our SDA customers got their entitlement to XDR and we built the whole transition program for you guys.09:15And as you can see by this slide, we've been working on it in the background, you know, pretty consistently started off in October of 2024 with the Meraki configuration. That was kind of our 1st big step in terms of.09:30This migration convergence and then May through July we started to bring things like the detection, the detection tuning, the GCP configurations were migrated over in May middle of May NBM.09:46Was migrated over. OCSI was introduced in July of 22. Oh NA data started to show up in the beginning or middle of August with CTB was a quick follow a week later.10:01And then we're starting to push on the subnet configurations in the XDR insights and your on prem sensors in XDR. Again, you're gonna see that 7 December date throughout the rest of this presentation because that is kind of the big date right now since that's the tentatively scheduled deprecation date.10:16Secure cloud analytics. So I'll call it out once, but I will call it out for the remainder four or five slides for these timelines. Log telemetry. So the log telemetry has been a little trickier. We did start at the end of.10:36September we started with, you know, trying to move over some of the netflow logs and some of the audit and activity logs in XDR. We're continuing to do that. It is in a phased approach. You know, we started to do a little today.10:53Little last week, we're gonna continue to do this next week with you know the expected completion date of the October to have all of our customers in their cloud network flow put it over to XDR. So before I continue on with.11:09More timeline slides, this is where I do tend to like to stop, see if there were any questions that have come in so far. Oksana. Peter, do we see anything? There's NO questions so far that I think I know you called Exan out, I just happened to be looking. I think Oksana I don't see any questions, but it's a good call out Danny.11:27We are.11:47Adjusting, I think is the, is the great wording that you highlighted there, the timeline based on customer and partner feedback with needing a little bit more time to potentially implement the configuration settings required to receive data into the XDR backend for those customers that had not fully adopted.11:49Opted access into XDR and the full functionality yet.12:08That's where you see the 17 December timeline coming in and where Viable still highlighting the move of making data and telemetry available in the XDR backend and in the XDR user interface available through the activities viewer where possible up into the.12:13The 18th excuse me, up until the 14th.12:33Of October, and while we wait to cut over things like AWS configurations and continuing to move forward with the other device insights data that would come over through SCA. So just calling out and re highlighting what Danny said, we'll continue to provide updates. You may have seen a gap in.12:36In our email communications over the last week or so, that's partly because this was being discussed.12:56And on this customer facing webinar, we're highlighting for customers and partners that we will highlight that detail further through the customer email communications as we continue to adjust the schedule based on the need to move the detection.13:03Migration out further closer to 7 December. Awesome and I did see a couple of questions come in from the dynamic duo of Greg and Philip.13:21I couldn't catch them both but I did see something. Yeah, so one is when is the new incident tuning feature going to be released? I don't think you got to that slide yet, Danny. It's the next one? It's the next one, right? Yeah, why don't we go ahead and cover that and then we can come back to Philips.13:36Alright perfect. Okay, so for here in this slide and again we tried to keep the timelines grouped into, you know, things that made sense. So for this one in particular, it is the configurations in SCA and how they're becoming part of the XDR.13:54So we started again as Brianna has mentioned, you know, we're adjusting with the newer timeline based off of the feedback we're getting for our customers or from our customers and our partners. You'll see AWS device inventory is in 7 October.14:12As well as the AWS integrations. I think that'll be one of the bigger key things here is understanding that from the SCA to XDR side in terms of AWS, Azure GCP, those will be considered.14:29Integrations and they'll show up as integrations listed in the integrations page in XDR. They were kind of integrations, kind of configurations, kind of a little bit of everything in SCA that will be more streamlined.14:45In the XDR user experience. In terms of incident tuning 14 October is our target date that is the tuning that will replace this new functionality in SCA I know it's a you know a popular feature.15:01So we at least wanted to make sure customers had an equivalent there, the watch list configurations as I've mentioned those are also coming very very very quickly if you keep in mind that the 14th is nine days away.15:16It's right around the corner, but again, the key there is not the watch list themselves it's the behavior and the logic behind them next year that is going to be adjusted for that whole system. Entity groups on prem network devices and asset inventories will be there.15:32Azure, AWS device inventory, and again the AWS integration and next year is going to continue there as well. And detections is the next big one.15:50So detections are the biggest cut over. With this slide in particular, I feel like I do have to make one clear statement just because we've moved the deprecation date from the 24th through the 7th.16:07Does not mean that we are planning on slowing things down with the progress that we've made and the push that we have gotten from our engineering teams, from all of our teams, right? It doesn't make sense, right? Even with that extra lead time, we want to continue to, you know, keep the pedal to the middle and keep making progress on this.16:24Aggregation date, the biggest concern here is, you know, oh well now we've got an extra three to four weeks or we can wait and push this off or we can wait and push that off. No, that's not what we're planning on doing at all. I'm basically telling everyone to pretend like the date hasn't been moved so that.16:44You know, we don't lose any ground or any forward momentum in all the work that there's a significant amount of us have put into this so far. So with the detections cause it is our biggest cut over piece.17:01We're gonna be starting in the next couple of days, AWS Azure, GCP are you know top of the lists. Watch list and the custom detections are fast follow the week after with the cloud flow detections being a week right after that.17:17Again, these maybe adjusted if there's an issue we see or you know QA comes back and says we, you know, then we find a unforeseen problem that we really need to go and and look at, ok? That that gives us a reason.17:33Really all this does or to me, all the extended date does is give us more time to to test and make sure that nothing breaks you know before we launch the official, you know, SCA has gone away message.17:49But the plan is not to slow down. Yeah, and Danny while you're shifting slides, just to add to that, that means that anything like allow list rules to make sure that traffic can communicate to the larger XCR back end.18:04Need to be implemented as soon as possible. It means that our organization as Cisco is looking to make sure that we can provide access through secure cloud analytics and XDR.18:23Concurrently as much as possible, but ultimately that access through SCA will be cut off. So the responsiveness to the customer and partner feedback is to give you that additional time.18:38Either as a partner or as a customer, I see we have about three or four different organizations from APJC on the line today in addition to Cisco staff to make sure that as an organization, you're as well prepared as possible to make those changes.18:53Not to prepare for any further delay. So if you have any questions on how to make those changes to ensure that you're seeing the data as early as possible before we make the detection cut overs, the configuration cut overs, any of the other.19:10Line items that are listed here where we don't have full clarity that you can do that and Danny is getting to this in a minute, but since I have the mic, I'll just highlight that there are still some items that are in discussion, things that were intended to cut over after.19:29The user interface deprecation from secure cloud analytics originally on 24 October. Now that we are extending that deprecation and shutdown to 7 December, the intention is to try to pull in some of the capabilities that we weren't able to define timelines for previously.19:46So while we don't have those dates for you here today, we will be coming back with those shortly through email and through our webpages, and I will be posting the links very shortly to those in the chat space. So we encourage you to keep looking and referring to.20:06Our documentation, our release notes, our email notifications, and our SCA to XDR user interface convergence timeline webpage. Thank you Brianna. I'm gonna take it back to this slide just for this bottom little piece here.20:23Because it doesn't just pertain to the log telemetry, right? It does pertain to other bits and pieces. If you don't see it here on the official timeline, it doesn't mean that it hasn't been talked about or it isn't being discussed at the current moment. It just means we don't have an official date for it just yet, but they are.20:43Part of the plan. And then the last call that I will say is keep in mind that the convergence of this is not a one to one, right? We're not gonna get a hundred percent SCA into XDR. What we are gonna do is try to take the best pieces of SCA.21:00And put them in XDR. That's the goal. The goal wasn't to duplicate a product that already existed in a product that still exists. This is an inception. You know, it's not kind of how we want to do things. We want to give our customers the best experience possible.21:15Alright, so with the last timeline slide, you know, we started and again I tell we're gonna change it, but he wants his 2024 date. Technically it is 2023 because the whole point of XDR was to give our customers a singular user experience to begin with.21:35So that was the start date expected deprecation date tentatively tentatively, I think our moment is 7 December. Longer short of it, like I had mentioned at the beginning of our webinar, once that date hits, the expectation is customers will NO longer be allowed to access.21:53The SCA portal side of things, they they're expected to utilize XDR as their full fledged platform system. So how does this all map? Well, this is very similar.22:12To the slides I had presented at the beginning of our webinar, just a much more kind of one to one or clear picture of it. Alerts and observations become detections and incidents. The event viewer, you know, that functionality is handled by the activities viewer.22:32And investigate. Device inventory and context moves over to asset insights and device insights. Webhooks and exports, as discussed become automate workflows. Snooze, subnet sensitivity, entity groups.22:49Those are gonna be part of the incident tuning, the asset values labels, and the asset groups that are coming. So then what is not moving over? Easiest ones are stuff that actually isn't even.23:05You know, managed right now. Account management, email reports and administration. User management for XDR is actually managed by security cloud control now, right? We launched that about six months ago. So good news is, is that you will NO longer have to add someone in security cloud control and.23:22Had someone in secure cloud analytics anymore. All of it just done through that one UI. The email reports again make those automate workflows, you know, and then add the administrative tasks.23:38A lot of the administration is done in security call control but there are still some things that you can pull up and do in XDR which we'll get to. A separate network traffic search page and report, not moving over, right? We're not porting over the whole event viewer.23:54You're not gonna see 17 different little tabs above the event viewer that say passive DNS, NVM, AWS, Azure, right? The goal is to give you a streamlined singular view of your network activity and allow you to go and search for.24:13Anything you might need to, the investigate function in actually very very strong. And then summary reports and visualizations, full transparency, you know, a lot of the reports in secure cloud analytics were built because they look pretty.24:31And I would built as a sales tool. Most customers that I've spoken to, and that's probably about over 250 in my 40 years here, they really even look at the reports that what they do is they look at like the event viewer and you know their alerts.24:46But the reports themselves didn't provide a whole lot so again we're gonna trim the pat if you will, from that side and make sure that customers have a focused singular experience. Any other questions so far, guys, before I move on?25:06So Danny I don't see any questions. I was actually gonna prompt the same to make sure that our team members have clarity on what capabilities they're not moving over to XDR. Are there any questions we can answer? I know we've presented this a few times now.25:25But recognize that there maybe some attendees today that haven't seen this yet. Any questions we can answer? There was a question about configuration and management of ONA sensors. Yes.25:42We can circle back on that. So configuration and management of ONA sensors are going to be continued through in the XDR interface. Danny I don't know if we wanna pipe or move back to that timeline slide.25:58Yep, and actually, you know what? We won't do the timeline, guys. I will show that to you as part of today's demo and where that is because I actually do have that process. Thanks Sanny. In that case, I don't think we have any other outstanding questions, so please proceed.26:15Awesome. All right. So then the next big slide is also a big one, right? So these are some of the alerts that will not be migrating over. Detection life cycle management has been a big part of XDR and I do mean that as a whole, which includes SCA.26:33It's something that we have continuously done since the launch of XDR, we've looked at all of the alerts that we get or what we build, is it worth building? Did we migrate this over for NO reason, you know, and based off all the research we've done from all the backend data we have.26:51You know, these were some of the ones that we found were, you know, one obsolete not being utilized deprecated by their own, you know, providers, you know, that we're still supporting for some reason. You know, so I'm not gonna read them all to you.27:07But just giving you a heads up that not all of the detections will be porting over, you know, but there's a reason why they're not porting over. It's not like oh we don't want to do it anymore. It's the simple fact of the data doesn't support us migrating this over.27:23In clouding, you know, our back end up with something that isn't going to be utilized or utilized by three people out of our 1500, you know, customer universe. And then before, actually, and then from here we can.27:40Jump into the live demo.28:00So a few things I do want to share and show. We'll start here with our native detections. As I'd mentioned NVM has already been brought over. It has been since the middle of May. Around that time, we started to introduce under administration.28:03Our data detections, our detections tuning capability. These are all NVM detections. As we continue to add sources, this will grow. Very similar to the alert section in SCA, which.28:21Any of the original people know, you never actually saw this until you got data. At least here you'll get it right off the bat. So this is one, turn it on turn it off, you know, play around with it, you can change the severity if you want something and you absolutely have to have a.28:37You know an incident for it, you can go under the advanced settings, say yep, NO. Anytime a windows, technique TC is executed, I want an alert I got I want an incident. Turn that on, boom, you're done. As this grows.28:55Obviously its counterpart under the detection section will continue to grow as well. You're gonna start seeing more, right? And this is kind of similar to our events viewer not fully a one to one as I've mentioned.29:14But it is a view that does follow it to some extent. And as we continue to jump in, oh actually had to put it up here. This is what I wanted to share. Here under investigate activities.29:29And the prep because sometimes they can take a while depending on the amount of data, number of sources, what you're trying to search for. You can see this is also a very similar view to that event viewer. And as those sources get added you'll see more sources here.29:47When you 1st hit this page, what you'll actually see is this search bar or this filter slider. You'll be able to pull pick, choose anything you want to so you can get a nice clear view. What we found is that our customers usually.30:05Go to this page with something in mind, right? They don't want to just be thrown all of the information at once. That can be very overwhelming, right? But I look I'm looking at this detection, I want to know what this IP address is. I can come here or I want to know what this host name was. As you can see in our prep.30:25Things like AWS log, like we're prepping for it already so that when the data starts transferring over, this starts getting filled out more. Yes, those ONA activities are ONA data is available in here as well.30:45It's also why it's one of those sources, and as promised, you go under administration on prem appliances, the sensors tab is new. We just launched it.31:04The sensor tab has your information and has your built in sensors and where you can go, you can manage it, configure, you can view what you have available and I know some of you have several sensors and I I'll see that just kindly as I can. You know, so hopefully this page doesn't.31:21Get too overwhelming for you, but we tried to make this also very, very streamlined Cause you can see here, the sensor is working from the CTB side, but the recent TV sensor is not working.31:42Right red, nice and green, I'm sorry, nice and blue, right, so it's easy to tell what's kind of working, what isn't working, and you can go from there. So I hope that does answer your question, but it is here. And then as telemetry comes.31:51You'll be able to see that in the activity section. Thanks Danny. I think that definitely answers the question about being able to see the sensor configuration and where one would go to configure sensors moving forward and thanks Pradia for confirming that a customer.32:08Customer with existing sensors will not need to redeploy or reconfigure.32:26We do have one question that came in Danny, just in case you want to take it before you move on. It says native detection delays in Cisco XDR, it was shared that the SCA convergence will address speed of ingest and detection creation, any timeline around this. I would make a general statement that this is.32:40Is related to when the detections themselves cut over. So we're doing a work effort where we cut over a lot of the telemetry view 1st so that customers can get used to the new view of working this through the activities view that Danny is presenting right now, being able to go into.32:57To the activities view in the screen and then filtering into whether or not you want network or endpoint related data.33:17And cloud related data as Danny is pulling up right now, when we cut the detections over into the newer engines, that is when we expect the delays in the processing of that data through to native detections to reduce into a more.33:24Viable timeline. So you would want to keep track in our thanks Danny for highlighting that so we can see the activity data when we analyze this data and we produce native detections, that's the delay that we believe is being referenced in the comment and we agree, and that's what we're trying to improve.33:44Over with the modernization of the architecture. Please keep an eye on the timeline for when detections are being cut over as those detections are being cut over for cloud source data, cloud flow data, activity data. That's when you would see the difference expected in the timeline of that detection being processed faster.34:03Yep, and the goal is you'll be able to see it here as well, right? So these are your detections views, but you'll be able to see they created last verified.34:25As Brandon mentioned, right, the goal is to make this better faster, but there's gonna be multiple spots where you can go and check this information out and then as you go through.34:41And what I'll finish with, right? Just to give the, you know, our customers the streamlined view. And again, this is our test tenant, so, you know, Oksana I'm pretty sure there's nothing here that I shouldn't be sharing. It's our standardizing view.34:56Right, the correlation is one of our strongest parts of XDR itself, right? It's grabbing more than just a detection and saying, hey, look at me, look at me. Alert fatigue is definitely a huge thing in any security operations center for almost all security analysts based off of the 25 to.35:1240 tools that they have to manage on a daily basis?35:32We try to streamline it. And as we drive deeper into what our incident is, right, and you've got your summary, you can see your assets, you can see all of that fun stuff, you jump into the details, not only now do you have, you know, our Helios and our is an attack verification with our attacked storyboard.35:36You can also jump directly into the detections tab and see them there too, right? And with all of these telemetry sources becoming part or not part, but finally becoming, you know, more inclusive in.35:55The XDR platform, I'm expecting to see a lot of cool things start to happen even better and even faster. All right, so we can go.36:11Back to the deck and bear with me, there we go and the one thing you know before our last slide here, and we open it up to to QA is.36:27These are some of the most commonly asked questions you know that we've received over the last couple of months, so do I need to redeploy my sensor? Thank you again for reconfirming that. No, you don't have to redeploy your sensors or your cloud ingestion. Our goal again is to make this convergence.36:46As streamlined and as easy as possible for our customers, and also keep in mind convergence versus migration for converging the platforms, we're migrating features, that's kind of how I utilize the terminology, so that's why I kind of keep interchanging between the two as as.37:06We go through this PowerPoint. Do I need to migrate everything or every setting myself? Nope. The goal is to make it as easy as possible, so, it would be kind of frustrating for a customer, you know, who's one from SCA.37:24To get XDR is to start playing around in XDR to then have to go and reconfigure everything. And so our goal and grab what we are going to be migrating over is put it in the XDR tenant for the customers why that entitlement for an SCA customer who hasn't claimed it yet is so important.37:39It's why if you're an SCA heavy user, it is vital that you start utilizing the XDR platform more, right? Get to know it, understand where things are that way when you're actually in there, you know, post 7 December, it's not a surprise, you're not hunting for where things should be or like, you know, where do I go and I find my detections? How do I find it.37:58My tenant ID if I have to open attack case, can I go into the activities viewer and finally see my AWS? You know, questions that you can ask yourself as we migrate those features over, at least familiarizing yourself with the user experience in the UI for XDR.38:18Will help answer a lot of those questions before you even need to do anything else. So what happens to your historical data? That is also a very common question we've gotten asked. So exports are going to be available through an API.38:37You are going to have to create a tag case for those exports. It'll be kept on the back end that will not be available on the front end. The bigger one I think and probably the most important question on this slide is that 4th one.38:54With the IP addresses where I send telemetry change? Yes. Right? Even though it's two UIs for one system SCA was there for a while. We had to whitelist the IPs back in 2020 to 24.39:09Right with this launching, we have to adjust those IPs so that it goes to the right system now. So yes, and there's been communications around this in which IPs should be on your allow list, there will be more communications around it. Please make sure that it's like the one thing.39:29We ask our customers to really review. Workflows for any notifications exports, IP white or sorry, IP allow listing needs to be crucial without it. We could migrate all the features we want over, but you're not pointing to the right IP.39:49That telemetry won't flow, and then the subnets settings watch list and entity groups, it's probably our 3rd most asked question because the watch list tend to be a really big deal here. You know, we are, as I showed you on slide like four or five.40:08Great. Yes, what this are coming over, any groups will be coming over, the subnets will be coming over, but behavior and logic behind them will be adjusted, right? More, you know, basically it'll be adjusted and streamlined is really the right word.40:25So NO more 3000 alerts, right? You'll probably get a thousand and not three. So again, any questions so far before we get the last slide? I think we can pull up the last slide Danny as we reinforce some of the points.40:41That you've highlight high highlighted so far. I don't see.41:01Any additional questions unless I'm missing them by all means Okxana, feel free to jump in and call them out in the Q and A there was a question or the ask to address the detection delays. I think we discussed that live. Okay, ok.41:06But there's a new question that just popped in. What happens based I think the question restated is does baselining continue after the SCA migration? If not, what is their baselining post SEA migration?41:26Yep, so keep in mind guys that it it's a common question as well and probably I'll have to speak with Logan on on getting that added, right? SCA when you 1st launched it, it, it was a 30 day baseline period, right? Where with XDR the expectation is you don't have to baseline as far.41:45Right or as long because we're pulling in data. So the expectation in the goal is that you're gonna have to, you know, you'll be able to get up and running quicker for our existing customers. There really shouldn't be any baselining needed because of the fact that that data has already been flowing to XDR in one way shape or form remember.42:03SDA is the detection engine behind the or in the XDR card. So it's just not like it hasn't been happening already. There's technically nothing too baseline. Thanks Sanny. With that, we'll ask for any final questions and use the opportunity.42:22Opportunity to reinforce what Danny was highlighting live on the call. So we understand that there are dates that we need to return to you with based on the fact that we are adjusting.42:42The final date of the user interface deprecation to 7 December tentatively. We don't have all of those dates for the new detection cut overs meaning meaning that the new dates for the detection cut overs for things like flat flow data for things like cloud.42:54Activity data and cloud API data as we would have previously. Those those cutovers were supposed to happen last week, this week and the upcoming week. We again delayed some email communications as well based on the understanding that we were likely gonna move some dates out so we can.43:15We can say with relative confidence that we will tentatively be moving the UX shutdown date for secure cloud analytics to 7 December. We will come back with a more definitive statement on that once we finalized a few key points both in responding to customer and partner feedback.43:34And in understanding our ability to adjust our timeline.43:54For cut overs based on that date. That being said, as Danny highlighted, that doesn't mean that all work stops. So we have two months, 60 days until that date. There will be telemetry cut overs, there will be configuration cut overs.43:59Things that would allow you to likely still see data within secure cloud analytics without disrupting that workflow or reasonably understand that you now need to move your integration and set up to the user interface for XDR, which has been the expectation as those cutovers cut overs have happened.44:19For over a year now?44:39And with that in mind, we would guide you to continue to move with that effort as for some of you who maybe partners on the line to encourage your customers to move forward with that effort as we highlight that information in our emails. So you will see an email this week for sure with updated information.44:41Information on what's been delayed, what the timelines are for those.45:01Those migration milestones to complete and where larger milestones like the deprecation and user interface shutdown have moved out and we will continue to keep you updated from there. So we have about 14 min left. Danny, is there anything you wanted to add to that around the shifting of dates or.45:06Keeping an eye out for communications. No, I mean I think you basically hit everything right on the head. Again, it's more so just these last three bullets but it is these three and again it's nothing we haven't said already, right? SCA only customers.45:26Please create your attack case claim your entitlement as quickly and as soon as possible. The longer you wait, the harder it will be for the migration and the more potential risk of data loss there is.45:44You may need to even start from scratch because you waited until of 5 December to to try and clean your entitlement and everything has been migrated over when we had nowhere to migrate your data to.45:59Great, your webhooks, notifications, please create those workflows, but that 3rd one is probably the biggest one. If you haven't or aren't utilizing the XDR UI or in the XDR UX.46:16Please do. Get used to it. It's going to be the only place you'll be able to, you know, do your detection response you know post that 7 December date. Thanks Sanny. That's a great call out. Unless on this call we highlighted that a date is changing or that.46:31It is tentative and likely to change. That date has completed that that exposure of data in the XDR user interface has completed and or that detection cut over has completed. So the XDR, the SCA two XDR transition program technically completed on 30 September.46:51If somebody tries to go and fill out that form currently, it will not work as we pull down that form and formally close that program. We can still, as Danny mentioned try to assist and help your customer, but there should be NO assumption or expectations set by any customer team members that.47:11Happen to be joining us for this call today. Hopefully many of you are joining us to understand how we're moving forward in this deprecation process and or any internal team members for Cisco that might be joining to support your customers and partners on this call. There should be NO expectations that that data will be able to be retrieved if.47:31The transition process was not claimed as of 30 September.47:51As you can see from this call, we are doing our very best to make sure that Cisco is providing information and updates on timelines as quickly as possible as we have them. And we'll note that for this group of customers and partners on the line.47:55You maybe receiving this information faster than some of the internal Cisco team members. We have many sessions both externally and internally over the course of this week to provide updates and it is during those sessions that we are highlighting the change in the deprecation date for the user interface. So if you do read.48:11Out to your team member in our Asia Pacific and Japan regions, including China and you're looking for information. It's possible that they have an update session coming through the course of the remainder of the week or with where they will find out the new date.48:31Of the projected turnout and shutdown of the user interface of secure analytics as well. Alright, we thank you for joining us for this, this kind of condensed update. We know that many of you have joined us in the past, so we didn't go through the whole process.48:47Of outlining the timeline again, and those questions in Q and A have been answered. So if there are any other questions, we'll give it another ten or 15 s for the team to ask those and call those out. Please feel free to raise your hand or put a question in chat.49:07And if not, after those five to 10 s, we'll close out the call today. So any last questions, please let us know now. Great, thank you Danny and Brianna and the whole team for bringing your knowledge to the Cisco community. Your feedback is important and at this time it will be directed to our event survey, please take your.49:23Few minutes to participate and let us know how well you enjoyed the content today. Once again, we thank everyone for joining us and we'll see you next time.49:43