Reviewing the final milestones for the SCA Convergence into XDR

Hello everyone, and welcome to today's webinar. My name is Peter Henry, and I'll be your moderator for this session.00:10I'm pleased to introduce today's speaker, Logan Buntrok. Before I hand over the mic, I have a few housekeeping items to cover. Today's webinar will be recorded and made available on demand after the live session. We will provide you with some details at the end. Also, we'd love to hear from you during today's presentation. If you have a question for our speaker, please feel free to send it.00:17Through the question and answer panel where our wonderful panelists are ready to respond.00:37So without any further ado, I'd like to kick things off by welcoming Logan over to you. All right, thank you Peter. We're looking forward to giving you all another update on some of the progress and dates and and things that are coming up as we try to get to the end of this migration into XDR.00:42Security analytics.01:02So the 1st thing we really just want to start with is giving you all an update and the update is really just a high level update on some timelines that are really critical. So as we've mentioned in the past, Cisco XDR is, is becoming really the main user experience that we're moving all of our SDA customers into, all the workflows that we've.01:03Trying to migrate into XDR and with this, we had to had an end of the end milestone which is really turning down that user experience. That is still true. We are still planning on that but we have worked through some customer feedback and some partner feedback and really tried to take that very seriously.01:23And provide a little bit of an extension into that. So we've moved the plan to shutdown date from 24 October, which was here in three weeks to 7 December. So same, you know, same process we've outlined in previous webinars. And again this is this webinar today is more of an update webinar. So if you.01:42Receiving.02:02On the overall transition, there's there's more content available in other places to kind of go rewatch, we aren't gonna be going through every single aspect and every single all the backgrounds which is more of an update. Do ask questions though. We will, we will take questions and we'll try to guide you to the right place if we don't answer it here.02:03So kicking off that with that in mind with some of the timeline changes and some of the goals of this webinar, we're gonna walk through a few details here just to kind of give some updates to what we, what we know best. And the biggest thing is we are tentative as we called out in previous webinars, we're doing our best to give you the accurate timelines, However, with you know feedback.02:22Acting with some of the things we learned along the way where we're trying to be flexible enough to make sure customer experiences stay, you know, stay intact and we can make sure everyone's operational. One thing that did actually get finalized and has now been passed is.02:43The transmission program. So as we've called out in the past and since 2023 when the end of with Cisco sorry secure analytics went end of sale, we offered XDR as entitlement to those customers and.02:58But one of the, one of the big things with that is getting customers over into XDR and getting the tenants connected, so getting cloud analytics connected to XDR is one of the things we really need to do to start sharing data, doing the actual migration on behalf of customers, you know you have to be yourself so that.03:15There wasn't as much heavy lifting to go through and, you know, reconfigure the whole thing, the whole product from scratch. This was part of this transition program that by by getting those things linked, this allowed us to do a lot of that and we've set up several notifications. We've had a program open for a few years now and that just recently closed on 30 September.03:35So if you still have analytics and do not have XDR, run immediately to tech tech and contact tech.03:55There maybe some ways we can help out here, but in reality the the program was really designed to to make the, the migration as seamless as possible. Okay, I'm gonna skip over a few things here. I just wanted to provide some updates. In the past I've given kind of the overall how things have changed and what to expect for changes. I will give a demo at the end.04:04That will sort of talk through some of this again to rehash some of the new updates, but I'm not gonna go through all the different, you know, mappings and all the things we've gone through in the past and very specific, very specific, you know, technical changes, terminology changes and all those things. What I'm gonna focus on today though is just the, the better recapping the timelines as well as updating on new.04:23New Timeline and new dates.04:43Where possible. So, We spend a lot of time on this, but recapping since November of 2023, we sort of started this process. We've really ramped it up over the last couple of years here and within the last, you know, six months we accelerated that substantially. But here's some previous milestones we've done in the past that were part of this program.04:46I've covered some of these in previous webinars, so I won't go into detail. I will I will demo some of this later, we'll talk through it. Looking at the kind of next bit of timelines, we start looking at what has been most recent. So this is where I'll go a little more detail so you have a better context into what are some of the changes you should look for an XDR if you have not.05:06Seen from our emails and from the release notes and things like that.05:26So since May of 2026 when things really started accelerating, NVM was our 1st migration. I did I have covered that extensively on previous webinars. So again I won't I won't go spend a lot of time on that. If you want more insight into that, there's definitely a lot of content out there, release notes and I will demo some of this. Since that time though, we've we've.05:29That are.05:49Since that time of May, we've done a few more things, we've added more activities. So these are really the network telemetry that analytics brings in today, the netflow mainly that we ingest, we log as session traffic. We started to display this in XDR, and that was really the 1st kind of.05:50Source of data that was beyond NVM we started to move into, it shows up in this activity viewer I'll demo this a little bit later, so I won't spend a lot of time on that, but again, we started to move the data into the product yet. We still had all the detections and we still do have all the detections in analytics. So if you're using the analytics today, you're gonna see the activity data, meaning the flow data.06:10In both places. From 19 August through 26 August, we moved to the two on prem sensors we have, we did the same thing. We started to route that traffic and that data into XDR. It started to show up in the activity viewer if you have access to XDR, but it still showed up in SCA in the event viewer as well as the detection still fired.06:30Moving into the later dates here, most recently, we we of course ended that program I talked about when it comes to the linking and the transition program where you had, you had XDR getting provisioned and linked and configured so we could do the migration.06:50And then looking at the recent date here, we've started to really dive into some configuration, some of our sensors showing up in XDR, like our ONA sensor e.g. and that kind of moves me into the next piece here, which is really getting into what's ongoing and what are where are we spending time?07:06So again, I've got very specific dates here, want to be clear this is tentative, please pay attention to our emails that come out. That's where we really try to message any updates as we learn to them. But in these webinars we do our best to sort of give you a current stated time snapshot, so you can anticipate what we anticipate to be rolling out.07:25Again with some put some flexibility back in 23 September, we really started this whole flow process. So the whole process of bringing that telemetry into the product you you saw I just shared earlier, we have ONA and CBP coming in, we have Meraki coming in.07:44So really bringing that data in, but still keeping it flowing into SCA, so the detection still fired, so you wouldn't necessarily notice anything if you're just using SCA, but it was showing showing up in XDR at this point in time for those sources. So we encourage you to check it out. I'll give you a quick demo a little bit later, and then.08:01This convergence will continue on with our cloud for our cloud customers who have flow logs coming from the cloud or activity audit logs coming in. We'll continue the same process where we start piping the data into XDR, but SDA still remains functional until we actually migrate the detections, which I'll get to in a little bit later slides.08:18The next piece I want to talk about is configuration. So there have been some updates already and things in process for configuration in particular, as I've called in previous webinars, I'll briefly touch on this again in the demo, but we have sort of the the inventory, so the asset inventory that shows up.08:38Under, investigate. That is getting moved into XDR asset insights. The subnet configuration is an overlay on that inventory like defining what is internal, what is external, what are my internal networks, some labeling of those networks with entity groups.08:57And then the the sensors that actually feed that and are configured to feed that inventory, these are all things that are currently being built out in XDR and being phased in. And I say phased in because at this point in time we're doing this by sort of by source. So at this point we have Google cloud.09:13We have ONA CTB, and we have all the cloud sources I talked about. We're doing them kind of in the, in that in a in a phased order. So most customers will not see any settings yet at this point, even though this is 1 October, there will not be any settings showing up for most customers in XDR, like our subnet.09:33Configuration settings will still be in SDA and there won't be in sdr yet. We will again try to announce through email our best when things are going live and when when you can expect to see them as well as pay attention to release notes which have a lot of the specific granular content on when things got moved over.09:52We'll then expand that starting here today into the next couple of weeks, the Amazon immigration. So as if you if you recall or if you're familiar, we have a whole integrations configuration page in XDR that has a lot of different 3rd party integrations. It has Cisco and and.10:08Internal integration setups, we're taking the Amazon integration settings from analytics, moving them into XDR, just like we do with Google Cloud. So this means we're actually not only bringing the configuration settings into the integration page, we're actually taking your settings and we're migrating them over. So you don't have to actually go configure them, reconfigure them, redeploy Amazon.10:27Or any cloud provider that you've, you've set up. We're gonna continue to ingest that data.10:47Into the product. And then it says data under review and the last one, but there's a bunch of work underway that we're trying to sort of plot out when is the exact release date gonna be. It's all in flight. It's all, you know, we've we've all internally here seen internal it working software, but we're trying to figure out when is it gonna get launched to customers and we didn't want to put a date on that because we didn't.10:53Didn't have a specific timeline, like a two week window.11:12So there's there's a tuning aspect, in the past I've called out the launch of, of our the removal of our snoozing function in getting replaced with incident tuning. The watch list function in totally migrated over to XDR, so we're gonna have the all the watch list that we played.11:15Going to support along with your actual settings migrated.11:35And then entity groups. This is again I've talked about this in previous webinars a little bit deeper. I'll briefly share what this means in XDR even without it fully released. But entity groups are really just labels and groups of assets that tell us, you know, hey, this particular IP range is.11:41Guest wireless or this particular IP range is my my finance employees, whatever it maybe. And this allows customers to custom tag them. We are bringing this over into XDR asset insights, which means you'll be able to label and group assets, configure prioritization of those assets.11:58On top of a network subnet. So very much similar to what MB Groups does today and we will actually migrate your entity groups and your subnet configurations over to XDR. Okay, well that's a couple of timeline updates and then i'll jump over to any I'll pause for any just to review any questions we've gotten in that wants to or.12:17Anyone to highlight and then we'll, we'll jump in and demo some of this.12:37So detections are sort of ok yeah so ok detections are sort of our last big chunk of work. So as, as we've discussed, we've, we've kind of covered the configuration aspect, We've the, the telemetry we collect and how we're bringing all that in, but the detections are really the analytics that run over all this and it's really.12:41The biggest chunk of work in this migration.13:01In previous webinars, I've covered how this detection, it's it's not just, you know, typing detections into XDR. It's a it's a literal rearchitecture of our entire detection engine to improve our engines in in SCA. We've gotten a lot of feedback over the last several years.13:05About how we could improve our detections, how we could improve our detection velocity, make it making things more flexible. These were all taken into account as we looked at this migration, and we use it as a time to really rethink how we actually could do, could generate detections where we had opportunities we couldn't get to in the previous engines due to architectural limitations and just where.13:22Where we wanted to also do some cleanup for some of the older, you know, techniques.13:42That we had in the product for detection that were not as relevant for the adversaries that our threat research teams were seeing. So we kind of use it as an entire cleanhouse cycle, but also a restart. And to give you an just to give you some data points, we did this for MVM already, so Cisco NVM is a, is a telemetry source that takes network flow plus process data.13:47From endpoints, it gets generated from an XDR and adds the detection that run over the top of it if you're not an MDM customer. Very much like we do with our other sources.14:07From previously this was an SCA and old SCA legacy engine, we had around 60 detections in SCA. At the time we migrated into XDR, we brought all 60 of those detections over in XDR, we wrote them all from scratch with the new modern architecture.14:17So there was some slight name changes. There were some slight logic changes in some cases, but generally it was a a net net improvement to make things more clear and easy for us to build the detections. And on top of that, within the 1st month, I believe we even we we launched another nearly 60 detections beyond that original 60.14:34So this new engine allows to quickly scale efficacy as well as coverage to those services just because of its.14:54It's because of its its more modern approach. We have the same components, same things being built here for netflow engine or cloud detection engine, so there will be changes, and I'll cover maybe some of those in if needed, but really want to focus more on the timelines here in this slide to give you some context. So, and that's also why.15:02Hey this is.15:21Kinda because there's a lot of changes when we rewrite detections, we want to make sure they all function. We want to make sure the alert volumes and things like that are are showing up appropriately for you. If we do make a logic change, that's for the better, it may have some impact on number of detections. We wanna be able to assess those things before we just blindly turn them on for you. So a lot of that assessment's happening in the background.15:23As we speak, it just, this is why the dates are a little bit fluid when it comes to this.15:42So starting in November we're focused on the cloud audit detections, so that would be from our cloud trail logs, our API activity across across all the cloud providers, Amazon and and Azure in particular, those two, getting into the middle of middle of the month, we have the custom detections, which this means.15:47Watchlists. So this would be our watch list detections that you've configured, we're starting to call them custom events because they sort of span beyond watch list. And then we get into 18 November, which is a little bit later in the month we get into our network netflow detections. So this would be our network based detections. With this, there is a new anomaly detection engine, so previously we had this thing.16:05Called entity modeling that that premise will live on. So if you're familiar with SCA and that whole concept, that premise lives on and it might slightly change and that's really well where why that one is last is really trying to make sure that one's gonna be precise with the migration.16:25And then to kind of wrap up here before we jump into any questions or discussion points, it's really about the actual turndown of the product. So we talked everything about what we're moving, but there is a turndown component of this, which is.16:42Making sure we've got kind of all the items we plan to migrate over into XDR and then making and starting to turn down the previous experiences as those really NO longer survey purpose. So that is targeted again for 7 December at this point again tentatively and.16:58When we look at sort of the current state, you know, that date again, keep that in mind for now, but look, keep us keep us updated, keep updated to the emails for the latest and and greatest. So I'll pause there. Any things we want to cover Brianna Danny that's come in?17:15Yeah, we have a few that have come in. So one or actually two questions I should say are around tuning. So to answer one of the questions, right? We actually do have detection tuning kind of already available, right? Where the NVM detections that have been cut over.17:32And I believe Logan will be showing that as part of his demo.17:52To answer the other more general tuning, I am assuming it is discussing the incident tuning, which, you know, currently has a tentative target date of 14 October, but you know again that's a tentative target.17:56So oh yeah he's already so let's let's call out the specific question. I know people are probably reading it, but there's a question for the detection tuning rules when they're released Logan, will they include the ability to add custom detections in XDR? So what if we can explain what our 1st target round for the releases, please?18:13Okay, so yeah, there's there's a couple questions, so there's a tuning aspect one and there's a custom detection one which are actually so when we when we roll out day one, what are we expecting to have available in incident tuning?18:32So ok I got I got it. So for incident tuning day one, we plan to have a it's essentially gonna be an overlay on all the incidents that are generated that allows you to filter and pro apply logic to what shows up here. So what that means.18:48Is we will have rule, a set of rules that you can either suppress the detections that generate an incident or promote those detect detections. And we're primarily focused on replicating what is currently in the security cloud analytics news functionality.19:05Which allows you to filter out detections at the alert list in secure cloud analytics. So that would be things like by device, by over a certain timeline. You could filter this detection type out for a time period or or forever if you wanted to from never showing up in this particular incident queue. So it would still fire, you can still go you still have the auditability here.19:21You go into XDR, and you go to the detections list, you would see it there, but it will not be allowed to be generating an incident in this alert list or in this incident list, which previously as I shared you as I can run through the demo here, this is really gonna be the main work surface.19:41To perform day to day job of of what do you actually work through? It's very much, very familiar, if you're familiar with the SCA alert list, you can go in here and you can assign, you can update state and things like that. Yeah, so I think I wanna call it one thing. It's a good question. We will have some flexibility as we continue to build out.19:58Incident tuning. It's called incident tuning versus detection engineering though purposefully. If you're asking if we will have full detection engineering capabilities, the answer is NO. That's not the intention for XDR based on the feedback we typically get from our overarching customer base as to how.20:18How much effort they would like Cisco to take on for them with an XDR solution versus how much they would like to handle directly. So our incident tuning is allowing for flexibility of tuning out false positives, making sure that you're maybe not getting incidents for certain things that you don't want or where you definitely want an incident each time to make that happen.20:38But it will not.20:59And it is not slated at any point in time in our roadmap to handle full detection engineering. Hope that answers the question. If not, please let us know and and definitely not trying to shut down the question. Just wanting to make sure you have the clarity that you maybe looking for. So please feel free to to follow up here in.21:00In Slido or in chat or with your customer success party from Cisco and we can, we can go through that.21:20There was a question that I think Danny you were, you were asking about or looking to answer, are ACE detections manually elevated to incidents being handled in XDR as any other incident when the migration is complete? So I I I had asked for clarity on what we meant by manually elevated. I do believe it refers back to what Logan was just handling. If you have.21:28Had selected the option in SCA to always promote to an incident.21:48Then be aware that those are not handled the same way as the items that go through correlation. So the the downside, the negative side of using that always promote to an incident either within the XDR console as it's available for the native detections or in the SCA console.21:53Is that you bypass our correlation analysis and our AI agentic analysis and inferencing. That is why our longer term plan is to allow you to handle how certain events and incidents are promoted through incident tuning, but ideally not keep that feature for the extended long term. It it will absolutely be there.22:12As the convergence happens and the UX shutdown for SCA happens and we don't have an end of life date for it just yet. But right now, today, and as you, as it moves into XDR for where you set up that setting, it does bypass our incident correlation, which we we don't recommend because we can't do the additional analysis for you when.22:32When that happens. That's why if you look in XDR an incident that is generated through that model does not have the instant attack verification or attack storyboard view because it bypasses that pipeline entirely. So know those if I, if we are understanding and interpreting manually promoted or elevated items clearly, those do not get handled. The same.22:52Same way as correlated incidents and we would recommend as much as possible you allowing the, you not not not relying on that feature using the process of the correlation pipeline to happen and elevate to an incident where needed, and you can still look at the detections themselves in XDR in the detections view if you.23:12Feel that you need to review those ones and you are able to see which ones were made part of the next year incident and which ones were not. So if you just wanna focus and your current operating process is to look at thanks Logan for adapting your screen while I'm talking. If your current process is to look at every single one of those detections for one or more sources in.23:32In your environment, you can do that. But this way you'll, you'll be able to see on the right hand side here when this pops up if it has related incidents and whether they have those or not. And then Logan, if you go to the related incidents filter, just next to the 66 results for me there on the top, this is where if you wanted to say, I I trust everything that came through with an XDR incident.23:52And I'm handling it through the incident screen or my automated workflows, but I want to still review the ones without related incidents. When Logan clicks that, those four that we can see on the screen right now that were part of an incident will go away. So that's your option to still look at those individually even if they're not promoted to an incident.24:12Well one more thing I'll add Brianna, the, the incident tuning piece does have, so we have sort of a let's get parity with what's in today over into the product, which is our very much like our function, the similar parameters.24:31At the incident list and then there's a there's a there's the next it's being built in with the framework in mind and the framework is is taking a lot of feedback from our customers around what's missing like where where do I see repetitive false positives that I know we're benign, and that is things like bringing in the file path, bringing in filtering by process. So some of those granular.24:49Suppression controls are planned. They just won't be as part of this migration effort brought in. So just wanted to make everybody aware that we have some beta customers who have given us a lot of great feedback. We have captured that and we've built around some of that on the and a lot of that is planned to be accessible from like this page. So if I see something in this list that I know should always be an incident.25:09I would be able to eventually go and say, ok, please make this an incident in the future because I I need to see this alert in the incident queue as an example or if I know from an incident lens, if I'm investigating an incident and I have detection in an incident that is included here and it's a known false positive I would be able to go and actually tune this out.25:28If I want to buy a specific parameter like that process. So just want to make that clear, that is not part of the migration scope, but it is part of the broader framework that's being built out and and again thanks for the beta customers if any of you are on the call who's given us a lot of feedback there. Thanks so much Logan. There was one other question.25:48But I think we'll take live, then maybe let's go through the demo and that may answer some of the additional questions. We see a ton of questions coming in too, so we won't take everyone probably live in in the event that we are running out of time, but we'll be answering them in Slido and in chat. There was a question around.26:08Seeing, sorry let me just go back to make sure I have it correctly. Actually let's take this one live. The ability to tune on more than just host names or IPs. Is that, is that something that we're looking at Logan and that's forthcoming or is that where we expect things like watch lists and other things to come into play?26:24So so let's, yeah, let's get them break this out by tuning and building a custom detection that you wanna take from a base telemetry like a netflow. From a tuning perspective, the answer is yes. And I just stated, it's not part of the initial scope to migrate over, but it is part of the broader framework we're building and again the beta customers have made that loud and clear that we we need to be able to tune beyond just an IP address.26:41So that is part of the planned, you know, intention of incident tuning is to go to the level of like a process or even like a profile path, whatever, whatever parameter you may need to tune on.27:02The other piece of it is around custom detections, so if I I just pull up kind of my window here I had around this internal connections watch list. So when we say custom detections in XDR initially, we're not trying to create a, a full up, as a full up sim function where I can take all data I have in XDR and swice slice and dice it.27:15Build any rule they want, but we are focused on replacing these particular watch lists. We have an internal connection watch list, a 3rd party watch list, an IP, a domain watch list, etc, et cetera.27:33These watch lists, you can do things like build out a rule on top of the raw network traffic or cloud logs and say, you know, if I ever see this fire an alert or if I ever see a connection to this country, fire an alert. This will get brought over into XDR. Your existing settings here will get migrated into XDR and these will be called custom detections available.27:43To administrator role privilege.28:02So the that is getting brought over and we don't have any plans to go beyond this. There maybe some, you know, enhancements and ideas we get to improve these particular rules and make them more flexible, but we don't plan to go into like, you know, building on ingesting data from any log source and letting you build a rule. It's gonna be very specific to the the native detections, the native telemetry from network.28:05In cloud that we ingest.28:24Thanks again, let's go into the demo, please. Yep. Okay, so we have a few updates I can kind of talk through, but I said previously I want to really talk through how things are gonna land. So I just gave you all the timelines in the last couple slides and I want to share what that's gonna look like and help you visualize it, even if it's not live yet. I'm purposely.28:31Like I said, some of this is live in our own staging environments. I'm not gonna show you that. This is in production just because I don't wanna, you know, give you insight into it if it's gonna change before it goes live.28:51So, high level, we have a few areas in XDR as a recap, and I'm gonna talk about where these fit into the workflow from an SCA perspective, so you get a better idea. We have the incidents and detections view. This is our replacement for the SCA alerts and observations view.29:02We have investigate activities. This is our replacement for the event viewer. We have the, automate workflow, which is a much broader set of, you know, opportunities to integrate export data set notifications. This is a replacement for the web hooks and the ability, some of the light configuration we had to.29:18Integrate with XDR or with SCA?29:38And we have the assets. The assets are where we, as I discussed earlier, this is where our asset inventory that we detect from the network, so we we bring in and we, we identify assets we see in the network traffic or the cloud assets coming from the API, this is getting it brought over into this device asset inventory at XDR.29:40And then lastly, of course, we have administration. This is where you do things like configure your sensors, configure your integrations I talked about earlier, and then there's some native detection settings here. So that's the lay of the land. That's how things map over from SCA and what we're migrating over and where they're gonna fit. And to give you a quick walkthrough of what are some of the.30:00So top of mind things I'm not gonna give you a demo of XDR but I'm gonna think about it from top of mind. As I said earlier, this is the landing spot for most customers and this is really the replacement for the alert workflow. A lot of the same functions we have in SCA, a distier and well beyond like AI classification, correlation analysis, all the things you know you.30:19Don't have an SG existing the incidents. I've covered that previously, what are some of the major differences and benefits of XDR? We'll cover that today.30:39When it comes to the detections, this is really, as we're gonna say earlier, this is our way to go and actually see all the things that are firing, you know, obviously from XDR like I've got here, but you can also see beyond XDR all the things you're adjusting in XDR. So we have our Cisco XDR checked here, which is our need detections.30:47This is where all of our detections will roll into, and you're gonna be able to see an alert list here that you can't necessarily work on. I can't, you know, I can't go and say this is closed, but I can at least review them. So I can go in here and if I click on one of these alerts here, this is an attendance drop historical outlier alert. This is actually.31:05Coming from a couple different observations in SCA and this is currently showing up in XDR. This is still getting generated over in so you can see I have a link here, but very much similar to how it's gonna look in the future. I can quickly find one, I'll show you a native detection. I may not be able to find one here in the.31:23Short amount of time.31:43But if it, if it were in a if it were in generating from XDR this link goes away, that's the only difference. So you would start seeing it show up here. And as Brianna said, related incidents is is where we can see if actually shows up in the incident list or it does not show up in the incident list. You can also see we have some.31:44Aggregation occurring here. So we have, you know, instead of looking at individual detections, we can sort of summarize them for a device if they're a whole bunch of them showing up. Okay, jumping over to the next piece of it, we have the activity view. So this activity view is our replacement for the event viewer.32:04And as I just shared with some of the timelines, we've, we've got quite a bit getting migrated over here. So this is a great place to keep checking out in your environment to see how things are changing. We have what we've done is we've essentially ported over a search page, so we're not just loading a bunch of data that's random. It's very targeted towards you coming here.32:23And you actually can select the types of activity you want to see. I'll cover what that is in a second, like what are some of the types of activities, what does this even mean? But 1st one I cover what the actual filters are all about. You can see here we've got a source of activity. So this is actually where we have the different sources that should look familiar from SCA.32:43And then we have individual filter fields. These individual filter fields are brought over from some of the most common, you know, requests from our customers. And by the way, we're getting enhancements already. Thanks to you have started to use this enhancements and where we're actually missing some important filters like subnet e.g. is missing a full siter versus just an IP. So, you get in here.33:02Play with it, check it out, give us feedback on what's missing and what you really need to do your job. There isn't not yet a download of all the data.33:22We did this intentionally because it's very cumbersome to actually get all the data, you have to break it up with the chunks and everything in the previous SC portal, so we're trying to reassess how, you know, how, how might a customer come in here and if they really need to build some kind of a report on this data and visualize it.33:29Like an accelerator maybe, how could we get them to do that? We're exploring some options there, whether it's a download or maybe an API or something we could provide. So getting back over to what's been migrated in the timelines. So if I go in here, you can see I've now got all these different activities showing up here. So in this portal.33:45We've, that means we've now started to turn on the ability to view some of these activities as they get migrated. So we have network activity, API activity, an account change activity, authentication, and group management. I've covered this in previous topics, but I will go a little bit deeper here just to reiterate.34:04We we currently in secure cloud analytics take the base telemetry, we turn it into an observation, and then we then we fire an alert. So we have something like a NetFlow record or network session turns into observation, which then turns into alert. In XDR.34:22We take the actual raw network log, we actually normalize that log into an OCSF activity, and then we detect fire detection, so we actually remove the observation layer and we add a new normalization layer on the actual raw log. What this lets us do.34:39As it lets us get this this nice search over here by activity type. So in this case here we can see we have network activity. Well, this actually is us taking all the flow like telemetry and normalizing it. That means not just netflow, across all the clouds and across the on premise environments, but also the NVM NetFlow record that has processed data.34:55And merging it into this netflow activity network activity record.35:15So that lets us actually search across all of that data in one view versus NSCA in the past, I had to go network session and I had to go to NVM to search for an IP address. The same can be said for cloud activity. So instead of searching across all the cloud providers in separate log buckets I can now search API activity across all my cloud providers. It's all normalized.35:18So it's a pretty big change. I want to make sure everyone's aware of it. It's gonna be different, but it hopefully will be better for searching across all the data. And then again you can also filter all the way down to your activity source, so getting down to the actual individual places you get the logs if you really want to slice and dice data here.35:37So to give you an idea I'll just I'll just actually run a a query over the last hour on network activity and let's I don't actually know which sources I have coming into this portal. So it's it's hopefully something comes up here, but this will actually run a search here and we have really designed this particular.35:54Normalization to be a lot more effective and efficient. So previously we had performance concerns, things like that. You can see pretty quickly. It brought back 10000 results and you can see it's a it's a very similar view where you have a search or source and destination IP in this case because it's network activity.36:10We've got a start time and you can also see that start time opens up a very similar details pane where I can see a lot more or I can take the JSON, look at it even deeper. Each of these activity views, if I go back to the search and filter here.36:29Each of these activity these gives us a separate type of view. So in this case here where I went back a page, that was my bad. Let me go back to activities. So if I go back to API activity and I run a search search I may not have an activity here at all. I'm not sure.36:44The filters, the the actual columns will adjust to the activity type, so it's customized to the actual best needed columns for the activity type. So I'm not seeing, you know, a thousand different columns that make those that aren't applicable. It's gonna filter down to the individual activity type as well. I just wanted to call that out.37:02And then lastly I'll kind of just cover two more topics. Okay here, this one did have some data cool. So you can see the type of activity, the actual name. So if you looked at cloud logs in the past, you can see this is a lot more efficient than trying to dig through what we had before. We tried to map it into, you know, sometimes something that didn't make sense, so.37:20It's it's all updated. Again, we'll take feedback if you have it as you explore it. Okay, as an inventory is the other big topic, so all the network inventory we bring into XDR into SCA today gets brought over to a nice list of devices. Those devices are showing up all over the the portal and.37:38We have a very similar function next XDR called asset insights. So we're just gonna reuse that and we're gonna start mapping the network devices into, into this particular view. So in this case here, I've got a device inventory. I can actually click on and see the device details. I can also see the different.37:56Sources of devices here in this view, I won't give you a full tour of advice insights if you haven't seen it, but there's quite a bit I can do here, but if I just go to one of these details, you'll see what it looks like and you can see I've got some basic context to the device. So in this case, I have Cisco Meraki feeding this. This is actually.38:16Coming from the Rocky integration that's direct cloud integration, not just, you know, our normal on prem collector from CTB or MNA. And you can see I've got some basic device information. This should be very similar to what you get. You'll get in from FCA as it gets migrated in, you'll have basic kind of IP context from our cloud. We'll actually have, you know, all the.38:34Cloud information we get, like, you know, the different.38:54Vpcs that's part of, the subnets, all the stuff that maps to. So, and then also the subnets column will get populated as well based on your subnet settings. So this is what the device inventory looks like in XDR. And lastly, with device inventory, there is a concept called labeling.38:59So here you can see I have OS version issue as a label in this case. This is where our actual entity groups are going to get mapped into. So we'll, we'll have another view here which will give you all the entity groups, all the assets will be labeled by entity group based on what you got configured in SCA if you use that feature. And what I can do with that is I can actually go into the rules function here and I can.39:15I set up a rule to actually.39:35We go to the add rule. I can actually set up a rule that gives me a particular setting of the asset value for that label, so I can select from the list of labels, I'll be able to select from the labels that I have once they get migrated like an entity group, and I'll be able to say for all my guest wireless, make these a low priority.39:38Asset so rate them of one. So that way when those detections come through the pipeline, they're only gonna show up as a low severity event in the incident view here. So this particular score is gonna be the asset risk value will be so low, this multiplication value will down a lot and these will be lower down in priority. So.39:58There'll be lowest in my list of priorities based on you know something living in guest wireless. And then what are the kind of wrap up here is really around this administration piece. We're gonna have all of the configuration you have in SCA brought over to this particular space.40:16For now we have native detections viewable over here and some of the integrations and data detections is really where all once we migrate the actual detections, like I talked about coming in November, they'll start showing up in the list here just like NVM does in this list. So NVM was completed way back when I forgot the exact date, but they now are visible here and not visible in SCA.40:34Very similar process where the actual settings detections will show up. If you've enabled the detection or disabled it, that configuration will get migrated over here as well. So be sure to check that setting.40:54And then lastly, there's a kind of a hidden feature here. If you see any detections that you're just like, I have got to see this in the incident list every single time. Like I can't I cannot have it never become an incident. I can actually go here and flag this thing to say always create an incident. And what this will do is this will actually trigger a back end process that says, ok, user says it's the high priority attemp.41:04It's gonna go through the full pipeline.41:25Of analysis and it's gonna show up in the incident list. It also means that if it were to fire an incident and we see another detection that relates to that same user asset device or anything that's correlated based on our current incident correlation rules, this detection will then get correlated. It's not gonna, you know, get create a duplicate or anything like that, that like it does today if you use that current bypass mechanism.41:27So pretty cool feature we again we asked earlier, we recommend, you know, try keeping it default because this could get very noisy if you're in a noisy environment and the incident list becomes useless. And so if you're in an environment where you know you have a detection that is not very frequent and very valuable to you, make sure you actually go and configure it here if you feel like you have to see it in the incident list.41:47Okay maybe to add around that as well, it won't solve the problem entirely for the concerns around maybe tuning not meeting the needs for false positive tuning and things of that nature. That's another area where the incident correlation helps because it doesn't do a blind aggregation of events. It actually analyzes to.42:06Determine whether or not these are a larger events if they are grouped together and with the agentic analysis, it goes so far as to call out where it thinks it might be a false positive or even penetration in security testing. So it's very valuable to rely on the analyzed events, not just the individual detections.42:26Yep, that's right. And if again, if you really want to see one of these show up because you feel it's it's in the past has been very useful and it didn't fire often, you can certainly go configure this and it will get analyzed by the AI analysis too, which is the benefit of the migration as well. This didn't work before from SCA if you configured something like this, so that now goes through full internet.42:45Processing correlation.43:04One thing I did miss actually I want to just cover. So we we do have some things showing up already in XDR that I forgot about, but they're still visible on SCA. So if I go over to the configuration for on prem appliances, this is where your on prem sensors are not gonna be showing up. So if I go to the sensors view here, you're gonna see a very similar view for these particular ctbs.43:06We've got a heartbeat received, heartbeat sent in the last flow record. So you've got your same reporting if you have on the report page in XDR now showing up for those sensors. And again, as I said earlier, you don't have to go do anything. This just gets pulled over. We're not making you go configure anything here to read to make this work. And then the installation steps as well are available here just like the RSC.43:25Okay, that is it now Brianna, we can pause wanted to fill the last bit in there. That's perfect. Thank you Logan. There are a couple of questions that are coming in that I would, we're gonna try to answer directly live, but they're, they maybe very specific to in individual instances of looking at data, not on mass.43:45So I would highlight, my team and I here would highly recommend that you engage with your customer success person to show screen and view those live. But there is a, a question around enrichment of data and whether or not AI inference analysis is being applied to all detections. So, I mean the short answer is absolutely.44:06Absolutely yes, Unless something is broken in your environment, any detection, not just native Cisco generated detections because a lot of the questions around that are specific to SCA, please keep in mind that XDR goes beyond the native detections that X SCA would have generated previously.44:26From a source perspective, we can bring in detections from multiple 3rd party solutions as well, and that could be anything from a different EDR solution like CrowdStrike Microsoft Defender for endpoint. If we don't have a native built in custom integration, you can still bring data in through our custom security event ingestion workflow.44:43And that goes across email security, it goes across identity, it goes across, it coming soon endpoints and network items as well. So different types of firewalls, different types of network detection solutions like dark Trace et cetera.45:03So when when a detection is ingested into our pipeline or natively created, all of that goes through all of our incident correlation pipeline. I say that because not all correlation is AI analytics. There's not a need.45:17To to run AI analytics across everything, to get some basic deterministic application and that's how we make sure that we use AI meaningfully and are able to bring capabilities like our agentic analysis to customers without raising our costs, which we did without having to do that multiple times now. But we run it through different.45:32Applications of deterministic aggregations, machine learning, agentic inferencing with llmiss.45:52And that's what Logan is showing here. So I'm not sure what we mean by like enrichment is an after the fact or a pre fact analysis component. It is not a statement of an incident that Cisco makes as an XDR as an incident. So yes, we do different levels and layers of enrichment that could include with threat intelligence that you have.45:59Have connected to the system, not just the built in Talos threat intelligence. You may have applied additional sources like virustotal or some private intelligence that you have about your environment. And so we will, we will provide that enriched contextual data on things like assets, users, and devices. We will use that in certain areas like is shown here to highlight if we know.46:19Know that something is malicious through a reputation that's already available from something like Cisco.46:39Or another source. And then the agentic analysis is really about being able to understand what happened. Can we clearly state to someone that there is an endpoint telemetry event and or an endpoint detection? Like I said potentially even from somebody like CrowdStrike and not Cisco, that connects, that indicates that there is a.46:45Be a potential command and control connection going outbound through a process from that environment and that that is correlated with network traffic that we have coming into the environment that confirms either a known or a suspected C two system. And that's an example of where we would put data like that together and and Logan is highlighting and showing a.47:05I don't know if it's the exact same example, but it is showing that there's, e.g., here, CrowdStrike from an endpoint detection event flagged a renamed executable running from the administrator's home directory with a base 64 encoded command, so not good, right? Why would that be encrypted? No reason for that to be encrypted most of the time by an an organization.47:25Admin unless it's something bad that performed an anonymous, again, not ideal LDAP enumeration against the Cisco owned IP accompanied by a corroborating network connection to port 389, so indicating unencrypted LDAP on that same host. So this is how it brings the data together from multiple sources, which can include native Cisco detec.47:45Actions, but for those of you that have been primarily working out of SCA and maybe haven't connected other, other sources to the environment, it goes beyond that to bring that data together.48:05So that's the longer answer. The shorter answer is yes, everything is going through agentic analysis unless it's one of the legacy system incidents in your environment that was turned on that was available in your environment before we turned the agentic analysis on in the end of July.48:15And hasn't aged out yet or if it is a manually promoted incident, one of our legacy ones that we, that we had not turned off yet for our secure our customers who were using securex that cut over, that were things like auto promoted umbrella or Talos blog events or if you had pushed that button that said, always promote to an incident in SCA.48:32Those bypassed the pipeline, so they could not possibly have the agentic analysis, but if you were allowing the the detections native and otherwise to go through the system.48:52They have a gentic analysis applied, which includes any enrichment that would go as part of that effort. Sorry, I wanted to provide a little bit of a longer answer there so we had a hundred percent clarity. Logan there was another question that came up that I want to make sure we ask answer and I think I'm good.49:01Gonna be mindful just for everybody on the line of the questions that we're answering. Some are more generic about XDR, I'm gonna prioritize the SCA convergence ones. If we have time, we will get to the more generic questions, very happy to go through those. And we do have quarterly webinars that we host for customers. This is a special quarter because of all of the work around the SCA convergence source.49:21We're having these monthly, but if we don't get to your question and it's more about general XDR functionality, again, please, please ask these to your aligned customer success manager. That's exactly what they're there for and why that that awesome role is built into the XDR entitlement. So there's a question about.49:41I I think that the question itself is webhook from Splunk Enterprise Security to XTR can be configured as an XDR detection rather than be promoted via incident tuning to have an XDR incident for SOC based on investigation happening in Splunk ES. I'm gonna I'm gonna reformat that a little bit in my answer.49:58You, we have bidirectional functionality between Cisco XDR and either Splunk core platform or Splunk Enterprise Security, where we can pull data from core or enterprise security. For core, it would be an event or finding from enterprise security. It would be a, a finding that has had some.50:18Space analysis process most likely already provided on it. We can pull those in and as almost like a custom detection that would show up.50:38And in our custom detections, I'm sorry, in our detection section, and because they're pulled into our data backend, we can then process them just like any other event that gets in that gets pulled in through correlation and analysis. So you can do that vice versa, a Cisco XDR incident.50:47So based off of data that's already come into Cisco XDR, including the native detections that are generated from XDR and are not available to otherwise pipe into Splunk in any format, we can take those incidents.51:06And send them over to Splunk Enterprise Security and because there's already been a level of risk and agentic analysis applied, they can bypass the risk based analysis but be available for the additional detection analysis and workflows that you might have set up in enterprise security, in core because there aren't those workflows built in.51:21Whatever you have manually set up can apply, but it will simply just move over to be another event that can be leveraged in this funky ecosystem.51:42All right, I'm looking for Logan, is there anything else? I know we have about 5 min left. Anything else you wanted to cover live? No, that questions are important for sure. So, ok. There is a question about Cisco KBD.51:53Documentation which identifies assistance on configuring an ONA to communicate with XDR. We we do have that. I believe it's in either the existing secure cloud analytics documentation and or the XDR documentation. I'll try to pull those both up with the 4 min we have left and drop them in chat quickly. If not, we will follow up offline if we run out of time. Again.52:13And or if you, if you get to your customer success manager before you get to us.52:33By all means, please ask them. That's part of onboarding and getting you into an adoption mode that they're aligned to do. They're, they're not there to do hands on work or answer every single question for sure. But they're definitely there to help with those onboarding and adoption type questions. Thank you. Yeah, you exactly you went exactly where most of we go.52:37He is all over it as we talk. There's the full installation section under the sensors tab and administration as well that has the information you're, you're looking for. Thank you so much Denny, so Logan, can you just highlight on the left hand side how you got there again? Now that this is in XDR, so they go to administration on premises appliance.52:57So this is the new screen now that the sensors are managed.53:17Through there, so you don't even have to go try to hunt for documentation. And then when you click on sensors and then installation, it highlights, it gives you the sensor image so that you can download it to get set to deploy that ISO as well as the installation guide. Thank you, Danny. Thank you Logan.53:20I wasn't staring at you, your screen Logan, sorry while I was looking at the question. Yeah I I think the biggest, so this is the same same guide right now for SCA. This will get moved to a new website, but generally it's the same process. This is the parts paid entity in the bottom here is this list of IPs used by XTR.53:39So this this will give you the latest and greatest in what we, what you need for configuration for things like outbound data from a firewall or something like that so yeah ok so maybe I'll just answer. There were two other questions going back to the Splunk bi directional integration, it's.53:55There's a workflow for this, so I would highly recommend that you go into our automation section and into the exchange and look at the workflow. It will guide you on how that needs to be set up and how to work through that. Everything is that we just talked about live is working. These exist, these have nothing to do with the SCA convergence I see.54:15Say it that way just so that you know that it's been available well prior to this effort and has been running for some time. So Logan is kind of highlighting on it right now if you see in that second to last row on the screen with the Splunk green icon, it's Plunk Enterprise create XDR incident.54:35And then the ability to have the data pulled in is also available as a published workflow because they're both Cisco solutions. So we try to do as much work for our customers as possible there. And we don't, I don't see any other SCA specific questions, so I will take the last question that I do see unanswered for our team.54:52Around Cisco identity intelligence. So it asks if Cisco identity intelligence assets and users are already fully synced with XDR and how often the sync happens. We won't have enough time to go into the detail on this there are some detail in the documentation. The sync happens based on the CII integration set of that, but I will highlight CII.55:12The assets that it has are users, Cisco identity intelligence for users and ITDR context is built into the XDR offering. So Logan is showing our asset context users, sorry, excuse me, asset insights section of XDR with the user's area, and if you configure your Cisco identity.55:32Intelligence integration, which is done through security cloud control, then we will automatically start getting the user information back into XDR. In fact, you can only configure it through CII.55:52So XDR pulls it from CII, which is a common service that's available to multiple products in the Cisco portfolio. That's why you configure the sources for it like entra in CII, and then it will pull user context and it will generate threat events that we're not able to pull yet directly into.56:02The XDR console, but you can use custom security event ingestion with a Cisco provided workflow to pull those in, which will then go through the correlation and analysis.56:22And with that, we're at time. So we hope that the change in the deprecation date for the UX gives some of our customers additional time to do things like apply, allow list rules, know that we're still cutting things over as we go down that path. So as mentioned, we will have updated.56:33Timelines on our FAQ website, on our emails. We've been working through that as Danny and Logan mentioned and I'll call out that Danny Logan and Carol are the exact people working on this live, so this is not people translating information to you that are not the people actually doing the work, working very hard to make sure that we have updated timelines and clear.56:52Understanding for everyone so you can map that to your own internal change processes, but we're still very excited to bring all of this work to you and so keep keep.57:12Joining our webinars, please keep reading our emails. Keep, please keep paying attention to the in product notifications. It's critical to get the latest information and if you have a question that goes beyond that, please feel free to reach out to your aligned customer success manager. Awesome. Thanks everyone. Have a great rest of your day.57:23