Secure Cloud Analytics to Cisco XDR: Convergence Update - APJC

I'll everyone and welcome to today's webinar. My name is Peter Henry and I'll be your moderator for this session. I'm pleased to introduce you to today's speaker.00:01Danny Roger, you guys?00:20Before I hand over the mic, I have a few housekeeping items to cover. Today's webinar will be recorded and made available on demand after the live session. We will provide you with some details at the end. Also, we'd love to hear from you during today's presentation. If you have a question for our speaker, please feel free to send it through the question and answer panel.00:21Where our panelists are ready to respond. And without further ado, I'll pass it over to you, Danny. All right. Hello everyone, how are we? I guess we should start by actually sharing the title slide so you guys can see what we're gonna be talking about and discussing today.00:41So 1st of all, welcome back to November's installment of our SCA UXTR convergence milestone timeline and update webinar. We've continuously done this over the last several months to give our customers and internal stakeholders the most information and most up to date information as possible.00:57So with that, some of these slides we will be reviewing in a quicker manner just because they are repetitive, and we've got a significant amount of information to share around detections. So.01:17Jumping right in for today, we were going to start with discussing our convergence progress since 7 October, where the SCA work will appear in XDR, the 4 November in 12th detection groups and cut over, I understand that today is the 4th or the 5th for some of you.01:32You know, so you should have seen some changes happening today and then you will continue to see more changes in the coming days as well. Your readiness actions, what you need to be aware of and understand and do, and then we'll close out with any customer questions and resources.01:52So jumping on in, we have our account, our convergence foundation. So just to recap very briefly, the convergence isn't something that is net new or something that has just been thought of over the last six months or a year. It has actually been a work in progress since the launch of XDR and since secure cloud analytics went end of sale back in November of 2000.02:1207:23. It started off with the Meraki configuration and integration and a closer tie there, which was launched in October of 2024 and throughout the years we have continued to add more functionality and bring the two UIs closer together with the end result being a singular platform for our customers.02:32To be able to utilize in their security operations centers. As you can see, we've got the section findings viewer, we've got the GCP configuration that we've launched, you know, and then we had the OCI source that was introduced. So the bigger question I'm sure on everyone's mind is.02:52What has really changed since that October webinar that we have had. So a few things. One, the deprecation date was moved to 7 December. This was done on, you know, in guidance or in conjunction with our.03:11Our customers and partners and other internal stakeholders, you know, we heard, you know, from several customers that, you know, they just needed a little more time and we were more than happy to, you know, acquise to the to that request. We have plenty of other things that we have been working on in.03:29And launched.03:48And cut over or migrated to the XDR UI. E.g., you'll notice that AWS the integration configuration has also been moved over from SCA to XDR with Azure as a fast follow that is actually happening very, very soon. We launched our incident incident tuning.03:49Capability that several customers were very, very excited about.04:09And then we are continuing to migrate over our sources, other administrative features and functionality as we go through and close out on the convergence. The big story for today, as I've mentioned, is our detection releases. You'll.04:15Probably have noticed you received a couple of emails in the last couple of days and you'll probably get one more tomorrow that includes a detection migration guide which lays out almost everything that we're about to cover in this webinar.04:33So I do highly suggest that you review that document so that there is NO surprises on your behalf. We have also introduced plenty of other capabilities and again this is just a quick recap. We're not doing, we're not gonna go deep diving here, but.04:49But as you can see on the 23rd, we did our cloud flow flow logs.05:0830 September are subnets and sensors. Those are now under the administration section. We reviewed that during the last webinar, and then on 14 October AWS and the tuning is when those were launched. So as the recap, right, I'm going to immediately jump into the next question as to how is this all going to work within X.05:13PR, where does it, you know, what does it look like?05:33This slide, if you've joined October's webinar or any of the previous ones, you've seen it before, right? And it's just a quick kind of summary like it's the way SCA works today, you get your netflow, you have your cloud logs, you get your detections, you have the MVM, right? Those were turned into observations, and then those observations became alerts.05:36With XDR, you get the same functionality in terms of your netflow, quote flow, NVM, right? With the bigger difference being that we introduced the OCSF activities layer, that is our normalization layer in order to help with our correlation engines and bring you guys.05:55Full detection findings and then those detection findings get correlated to become full incidents. So then the next most common question we ask is, ok, well, where can I find all of the stuff, you know, that I would I'm used to seeing in SCA? Where is it in XDR?06:12So to quickly recap, your SCA alerts will become your XDR detection findings. You'll be able to see those in the detection viewer. The SCA event viewer will become, is already actually in XDR is the activities viewer, device inventory and context be under our device insights and asset insights.06:29Our SCA webhooks and exports, those will become workflows we have stressed over the last six months, the importance of ensuring that your, your webhooks and notifications are updated and your Cisco XDR workflows are created.06:49And then your AWS configuration and tuning, that is under our XDR administration, incident tuning and not listed the integration page in XDR under the administration section. So for a quicker recap.07:06Cloud telemetry is still continuing to be cut over as I mentioned, we've already done AWS, we are working on Azure that is coming up next. And then, you know, we're going to make sure that we have our outbound traffic and IPs all set up.07:25We have sent several emails about the IPs. If you are a customer on today's webinar, please ensure that you are checking your emails and implementing the IPs that we have sent to your allow list since those are different than the IPs that SCA uses. Keep in mind, they are two.07:41Separate UIs and separate systems. They are now converging into one. We need to make sure you are covered on both sides. Now the big stuff. So as I mentioned at the beginning of the webinar, you'll notice you know some changes in the detections.07:59So the the main point of today's webinar, and you'll see what the next about 15 slides or so, is going to cover all of the detection, migration, plans, deprecations, almost anything else you can think of when it comes to detections.08:19So cloud detections did migrate over today. We do have additional detections like our network and cloud flow, our custom intelligence and anomaly detections. Those are scheduled to be migrated over on the 12th, and then we have additional detection groups that will be coming in December and in all.08:38Fairness.08:58We do have other telemetry sources and detection sources that are planned but do not currently have a date. So email threat defense, ICE passive DNS, and Sal are, you know, five of our biggest ones in terms of sources. We wanted to call those out here clearly to let you know that we have.09:00Haven't forgotten about them. We just don't have a scheduled date as of today.09:19So let's jump on in. These are the plant detections, the plant detection migration, so these what you're about to see were released on, you know, today, but a couple of things to call out and the reason I am keeping this.09:27Slide up for so long is so that you have a chance to read the note there While we are migrating our detections, they will trigger in both SCA and XDR until the deprecation date of 7 December. However.09:44As we are migrating the detections, they won't be ingested into XDR just yet, right? So you'll be able to see them in both, but they might not end up being part of our, you know, a correlated incident. At this stage, the goal is to make sure that our customers data is moved over.09:59Safely, quickly, properly, and then build out the correlation and implement that side of it once all the data is on the XDR backend. So I'm gonna pause here just for a second, see if there were any questions or if anything has come up cause I can't really see the chat.10:18While I'm presenting. I haven't seen any questions come in Danny. Okay, don't be scared guys. If you do have a question, please feel free to put in the chat or the the way slide as Peter had mentioned. So jumping right in, alright we have.10:38Parts that were released.10:58Our rules and room correlation for AWS, e.g., API key, IM trust policy guard duty snapshots, S3 access. You'll notice that even with the migration of the AWS full logs part of the policy is the guard duty get guard duty list.11:00You know, roll, right? And a customer actually asked me a couple of days ago, why is this here if we already have a guard duty integration on XDR and I said, well, if you had it in SCA, we need to make sure that we are still ingesting that data until it is properly moved to XDR so that you don't lose any data.11:19Rather be much more safe than sorry and then find out that you have a blank spot because you didn't implement the proper policies in your in ARN role. Our rule base, so we've got our snapshots for Azure Vmiss custom scripts, all that fun stuff, and then GCP again.11:35Password and policy changes, and then our organization's connected activity.11:55So we also do have a couple of examples here at the bottom, right? Cloud trail logging impaired, Azure VM run, you know, command executed, IM policy modified, all badge detections that we don't wanna see usually.12:01So to give you a more holistic view of all of the detections that we are working on towards and migrating, well let's get into the fun stuff and I am glad that I do have the rest of the team here because I know these, but some of these guys on on the panelists team have worked with them.12:17And.12:37Very extensively over the last three and a half to four years. So to start with AWS, it is usually our our most talked about source, sorry, AWS rule based alerts, accessing trust. So as you can see, I, and I'm not gonna read these slides one for one for you.12:38But it is to give you an idea of the breadth of the scope and to give you an idea of.12:59The detections that are being migrated over. So as you're going through and you're reading these, you know, pay attention to any detections that you might look at today and ensure that it is on our list. You know, and then what you'll also notice as we continue to continue to go through is that.13:05A detection in SCA might show up with a different name in XDR. AWS snapshot exfiltration, e.g., AWS EC two snapshot shared with external account, right? The detection, underlying methodology.13:23Means the same, just the label has changed. And Logan you can correct me if i'm wrong, but I'm pretty sure that's how this is working. Logan didn't correct me, so that means I'm right. It's a win for me.13:38Alrighty, so continuing with AWS, again, I'm giving you all a chance to just kind of read through these, but you will see it we cover all of the major detections, right? Our organization exit attempts, potential privilege escalation.13:55Twice because we've got the two different methodologies under that so we want the development resource created or the Lambda function created cause technically you can escalate your privileges either way.14:14More AWS worry, this will be the last AWS slide and then we'll jump over to the other sources, but again, anomalous password reset, bucket policy backdoor, secret manager batch retrieval.14:34And some of the most common and most detected well yeah detected alerts I guess would be the right way to say that you know are all here and we're all part of the.14:52Migration that have happened today, then jumping over to Azure and Google Cloud and there are other rule based alerts, right, so transfer data to accounts.15:07Gcp's password reset, engine exfiltration, again, I feel a little silly going through and saying ok hey guys I'm just gonna redo the five detections ten detections on each slide and then what the corresponding.15:24XDR detection is gonna be, so I will continue to talk while giving everyone a chance to read through the slides themselves. And these will be available in a PDF site goes out in an email so you'll have reference to it later.15:40That they're available already to you, you should have received an email to pick up where Danny is is highlighting these. What we would like you to take away from the webinar today, is that we have started the enablement of the new detection pipeline. So the way to.15:57But to think about it is this is your reference guide, and as Logan and Danny have mentioned, we shared a PDF document that is available through the link in the email. It's available in this, in this deck as well that will highlight.16:17It is not a publicly available resource, so you have to go through your email to access it and it explains in the email and in the documentation itself that that is to make sure that we don't have a document out in the public that lets bad actors know how to go around our and your controls for.16:31Were malicious and nefarious purposes. But what we did yesterday in this group's time on 4 November in US timing and in some, some countries APJC timing.16:51Is we began the enablement of that new detections pipeline. So for the last four or five months in these webinars, we've been highlighting that we are modernizing the solution, as Danny mentioned, they're making these detections better. What we did is we took many of the most common attack vectors.17:04As Danny highlighted and we not only continued those detections, but we we create we transformed to them, we made them better. So in many, as Danny has outlined here, AWS is one of the sources that we, we ingest and obtain the most activity and audit and API data from.17:23Out of the cloud providers that we have. We don't, we don't ingest or receive any of that from Oracle. We have it from Google cloud, Azure and AWS, and AWS is the most fruitful in data. So we have the most detections there that we are migrating.17:41When those detections were migrated, what we wanted to make sure you could do, and you'll see this in the actions to take, is understand number one, if that detection is even a detection that will continue in XDR. In some cases we modernize detections. In others we decided that they were NO longer right for the attacker.17:58That are happening today or they had too high of a false positive rate. They weren't what we would call very efficacious detections. And when we get to that list, those have been deprecated entirely.18:18We've shared that on previous webinars, but we now have it in the guide for you to reference as well. So now that the enablement has started, you can understand immediately that those deprecated detections will not show up in XDR, and as you use these next five weeks or.18:30Four weeks really to change your operations model into using XDR for these detections.18:50You will know that you shouldn't expect to see those detections show up even in a modernized format. I think the the good part about that is you have four weeks and three weeks as of next week to really get used to that model and have your teams start to look and work in XDR more and more often.18:58For these items especially if your team was heavily using secure cloud analytics before in the interface primarily, even if your organization was using all of xdr's capabilities, maybe one team used one user interface, another team used the other primarily. We at Cisco have seen that be the case often.19:18So we've already asked you to start familiarizing yourselves with the detections as they would show up in their legacy mode, which is the left hand side here, the ones that say SCA alert. We've already asked you to start familiarizing yourselves with those and the detections view in XDR. Then as we enabled.19:39The visibility to the telemetry and data that we ingest. We asked you to start looking at that in the activity view. That was the next phase, and with that data coming into our system and well vetted and established to generate the new modernized detections, we've now started enabling those and we're saying, please start working out of X.19:59CR for those events. The old version will still show up.20:19In SCA, but it will not be sent through to the XCR incident correlation pipeline. The new events in the new pipeline will. So you'll know which detections not to expect at all because they're deprecated, you'll know which detections have been migrated based on this webinar and the document that we've provided.20:24And you'll know what their old name was and what the new detection that they mapped to is.20:44And I use that wording of the new detection that they mapped to because as Danny said, it's not a one for one in the same way that activity telemetry is not a one for one. We may have one or two SCA telemetry items that are expanded into ten.20:50In XDR because we break out those activities.21:10More specifically in the industry standard OCSF model. It's very similar with the detections. You may have one SCA alert that does map to one XDR alert and that's the only mapping it has. You could have one SCA alert that now has detection logic that is in more.21:14More than one.21:34Modernized XDR detection or you could have multiple SCA alerts that fold into one XDR detection. So you're not going to be able to look in SCA and look in XDR and OEC a one for one, but you can start to familiarize yourself with if you used to get certain.21:35SCA alerts in your environment. Maybe that was rather frequently, you will likely receive a similar detection in XDR, but also keep in mind that that detection may work differently. In some cases for customers we have seen.21:55In our analysis, that detections that trigger 300 times in SCA for the same set of activity triggered ten times in XDR because we're doing a better job of filtering out when that detection is a false positive and when it's real.22:13So we know that this is a lot to take in and process. That's why we've been doing this over a long period of time. That's why we've been having these webinars to share information. That's why we've been enabling these capabilities in pieces and why we're still doing so with this next huge migration phase, that we're so thankful that you're.22:33You're with us for and that we're able to talk about with you today and that happened yesterday.22:52And we want to make sure you have time to start looking in the XDR console for these events getting used to it and getting used to which events will not be there. Danny, I still don't see any questions.22:59Why don't we keep moving through the list and as you said, you're not gonna read out every single one, but we can read out what type of alert it is. And as Danny is doing that, you can take a quick brief view through the the left hand side and understand what it would map to, but we really encourage you to read that document.23:16Meant.23:36That has the most comprehensive information and it shares everything that we just talked about plus some additional information that might be helpful to you. Sounds good. Jumping in. And actually to Brianna's .1 thing you'll notice throughout a lot of the slides.23:36Guides is the wording, the guide.23:56The guide, the guide, the guide that's done on purpose because we have one as Priyana has mentioned, and it has been shared with all of our customers. So again, review the guide that is probably the safest place to go and honestly it's it's part of what we use.23:59Is to build out this deck, so what you're seeing here is what's there. So with that said, up next is something a little new. It's actually our correlation alerts, access and behavior. So again, this is where the detection or the alert might.24:19Be the same but act differently in XDR. You know, the methodology behind that alert, again, has been evolved and adopted for the XDR use case. The goal has always been to give customers the correlated incidents less alerts, right, and reduce that.24:38But.24:58Alert fatigue, bring them up with, you know, the mean time to to identify mean time to close. That's, this is part of that, right? It's us optimizing the experience, the correlation, and what a customer sees.24:58And continuing to optimize because it is in a one time deal to allow customers to move quickest especially in the security space. And we've got more for our correlation alerts as.25:18Specifically for the logging in Lambda alerts and then how they are moved over again similar alert, just the name change and the, you know, functionality of the alert being enhanced.25:38Yes, in this case Denny, before we switch slides, I wanna call out that this is an example of that not exact one to one mapping that we were discussing. So in this case, the AWS logging deleted and the AWS logging impairment, so two different alerts in secure cloud analytics and that all.25:58Other legacy alert model, can actually map to multiple.26:18XDR detections. So it's, it's a two to three mapping depending on the behavior, that same or similar behavior could trigger as an AWS cloud trail logging impaired. It could trigger as an AWS route 53 resolver query log config deleted or an APS VPC AWS.26:24VPC flow log deleted. And in this case.26:44What I hope you take away is it's more specific. So the detections are broken up and more specific so that not only do you have more clarity on what behavior happened in the environment that triggered the detection, but also when XDR takes that detection to do analysis and correlation for an incident.26:47It has more of the specificity that it requires to understand if this is a legitimate detection event that it should consider alongside other events or if perhaps it's informational or it's a false positive.27:08Oh Perfect, thank you again. Right, so as we continue to move forward, this is the end of the recent migration of.27:22Now group one, that's what we'll call it with group two upcoming, but before we go there, right, what do you do to validate after the enablement? One, check your findings. Jump into XDR.27:38Compare that XDR detection to the SCA alert and the source activity again, the names might be a little different after tuning the volume as Brianna has mentioned hopefully be a little different after the migration, but the safest way.27:54Check the guides so that you have it with you. Look at XDR and your detections, look at SCA and your alerts and see oh oh here's the SCA alert it should be this in XDR, I see it we're ok. Incidents.28:10Right, look at the detection findings, check your incidents, see what detections are associated with that incident. Does it make sense? Is it now what you're used to seeing from the SCA perspective? And then your notifications.28:26If you had the notifications in a CA, which we've already discussed, and you haven't built a workflow to replace it, it's gonna be really hard to check the notifications for you. All right? So I suggest you haven't done that yet.28:43Do it now. Please do it now while you're getting used to this so that you are setting it up and you are familiar with it and while you still have another three weeks or so. Yes, and Danny, one other thing that we'd like to call out around that is we get the opportunity to speak.28:59With so many of you, whether it's our product management team directly or our customer success team, team members like Ash, who's on the line or Okxana from our extended PM and, and technical marketing team. And we understand that you may.29:19Conductor operations response based off of those notifications. So in addition to making sure that they're set up just so that they're functioning, if you're reliant on that in your operations model to go investigate something, you will now have a gap in your operations for any of the.29:34Detections that have been cut over to the new pipeline.29:55If you did not set up that workflow for notifications in XTR. So it's something to set up in general, as Danny mentioned, we made that one of our earliest requirements early in, in March, April and May, if I recall correctly, even prior to the NVM detection.29:58Migration, but even as we started the remainder of the source and detection migration cutting cutting over and planning, we reinforced that.30:18So right now, if you didn't do that, and the list of detections that Danny just displayed are something that you use and in SCA you had a notification set up for, you will see that detection, the new one in XDR, you will see the old one in SCA, but you will receive NO notifications. So please.30:28Please make sure that if you're reliant on notifications in your operations process.30:48That those are set up and as Danny mentioned, you validate that they're working right on the money. All righty. So moving forward, we go to group two.30:53These are the sections that we have upcoming next week just like the 1st group though, it's going to show in XDR and in SCA. However, it won't be ingested into XDR just yet.31:08Your standard XDR detections, you know, will continue to work as they have been. But again, the goal is to cut data 1st, then correlate and enhance continue to improve.31:27The the engines that way So we've got our custom event alerts, we had mentioned that earlier on, I think like slide three, right? All the you know what we're called mappings are in the guide.31:43And they are shown across the next four slides. So you'll see AWS cloud trail watch list hit. Sorry, that one just kind of rings a bell because it's something we did discuss earlier today and I'm like, Oh wait, I know this one.31:59It is named almost the same, right? AWS Cloudtrail watch list hit. This is one where it's nice little. Hey, look, this one I know, I see. It's the same exact wording, same exact label. Alright.32:15The Key thing here, and what we'll jump into next are the country and user watch list mappings and here it is a little different. The alerts do behave.32:29More in the many to one scenario that Brianna had mentioned, right? So our country watch list, so we've got protocol long name remote access, right? We'll basically all boil down to country watch list hit.32:47Right, so as you can see even with just the naming convention where we're saying alright, we're gonna take these four to five different things, push it into the country watch list hit, right, that's the label and behavior acting a little differently than what you're used to.33:06We also have our anomaly detections, this is just the 1st slide for it. You know, these are exfiltration, reviews, reports, all the fun stuff, but you'll see kind of the.33:24Big one here where it is the one to many. You can see DNS of use unusual package size for, you know, listed twice, but then on the XDR section, you've got for usual large DNS packets and then you've got the internal DNS server acting.33:38Alright, so one alert multiple. So last two slides we've given you the many to one and the one to many as we continue through the anomaly detection cause as we know that is kind of one of the key things we do look for.33:53In our security operation center, it's probably the most common question. What is this anomaly? What caused the anomaly? How did the anomaly happen? All right, and then how do I fix it? Right, those are your basic security operations questions. So we've got a lot of anomaly detections out there.34:13Here it's a lot of closer to one to one just with some label changes and again the way the detections work, right? And it's that evolution in the detections themselves. This is the last slide I believe, for the.34:33Additional anomaly ish detections, but these are planned for later. So we've got our tour IPs and you know you can see it's a little one to one but we're changing it out so that it's a little more descriptive with the exit node.34:53And again, I still feel silly just reading detections too or alerts to detections so I think we can just call out that we're looking at more cloud based detections and Danny, is there a second slide for the I think there was one or two for the December prior to the shutdown?35:13Yep.35:33Yeah. So as, as Danny is mentioning, we don't have an exact date for these, but these are detections that based on the work efforts so far and the efficacy that our, our newer detections are showcasing that we believe we will have fully cut over.35:33Been migrated and enabled in production.35:53By the 7 December shutdown date. Many of them are cloud oriented. If you're a customer that uses your cloud capabilities today, as, as we've been talking through for the 4 November shutdown and some of the 12 November with the cloud flow, you can understand that these will be forthcoming.35:56The next section there, I think that's the last slide for the remaining could be forgetting one so as we move on and I still don't see any questions, I think I'll just queue up this section.36:14And we can continue to move through it as well. So we do have certain functionality that we don't have a delivery date for yet. We understand that this can cause a challenge for customers that are using this type of functionality.36:29Whether that's a source of telemetry and data coming into secure cloud analytics today, whether it is detections being produced off of that telemetry, so not just the ability to view it, but the detections coming off of it. Or it is something that.36:50Is a very specific capability for detection types. Unfortunately, as we've gone through this process, certain functionality both for source types like Cisco Firewall and for certain capability types of events, we have an, we have.37:09We've come to a, a meeting of timelines with our peer teams who are working on evolving their solutions as well.37:28And we need to now reevaluate how we migrate and modernize these capabilities. So what you'll see on the next few slides is that there are some capabilities and sources that we do not expect to be available, even by the 7 December shutdown date.37:37So when we shut down secure cloud analytics, this functionality will not yet be available in XDR. We are working to provide a date to you as quickly as possible as to when that functionality would be restored because we do understand that operating without it and without expected functionality.37:57Is a challenge?38:17And also you would need to know at least how long you would be without that functionality and what your alternate paths and options are. So e.g., if firewall telemetry is not visible in secure cloud analytics, can you look at it in firewall consoles and things like Cisco security cloud control?38:19On cloud control. That's one example. Are there there are detections being released from a security perspective from the firewall team and product that are comparable to the detections that were coming in SCA off of that telemetry? That's another example of not only the work around.38:39And but why we need to reevaluate how we move forward for modernizing and moving this over with those peer teams. And we did have discussions with them prior to starting this activity. We don't want anybody on the call to feel a lack of confidence in our ability to.38:59To conduct a, a smooth transition for you hopefully for the most part, you've seen that Cisco has done as much of the work as we can physically do on our back end for you to deliver our promise of a hands free or as hands free of a migration as possible.39:19But as part of our, of their continuing roadmap while our roadmap continued especially when we had to conduct some of the delays to meet functionality capability needs and customer requests, we have now converging roadmaps where what we were looking to execute.39:36On does not match what is on those teams roadmaps. So you'll see some of those components, the the short version is for some of you, there will be functionality that we are not going to be able to have available by the shutdown date. So thanks Danny for switching slides. This is the encrypted traffic analytics.39:56ICE session visibility which was enrichment capability forming for detection events, but isn't necessarily blocking details from certain detections or certain detections from firing passive DNS information.40:16Will have impact on things like domain watch list and domain capabilities for visibility in detection events in addition to those events themselves where they were viable, but you can see here it says DNS visibility and domain watch list hit depending on this telemetry, and then going back to my.40:32Comments about the firewall, the firewall events as well.40:52For that, that workflow. Any, anyone see any questions? Yeah, Phil asked one, I believe oh in chat maybe. Yep. Yeah, he asked it in chat. It was about the Azure storage access telemetry conforming.40:56Configuration again, as I had mentioned.41:16Earlier today the planned date is 9 November for that cut over. Yeah, and just as I also mentioned earlier in the webinar, right, please ensure that those IPs are added to the customer's allow list.41:19In order to ensure that we can migrate them as smoothly as possible. That's right now the most common issue that we're seeing with our migration in every time that you know we we try to move a feature over or a telemetry source over, we are getting blocked because the IPs are not on the allow list.41:37Luckily it is a very small subset of our customer base, so we can't stress that enough as well, but that is on a hundred percent must have. Yes. And as, as we continue to move forward and Danny we can go to the next slide. As we continue to move forward, you'll see that.41:58Our customer success team members will be reaching out to you if we still see that those allow lists are not enabled. So we have a path to maintain where needed the the visibility still coming into the environment, but we want to still make sure as Danny mentioned that you turn on those ideas.42:18Piece because that path will be shut down.42:38Okay, so this highlights a little bit more specific where those functionality components that are, that may not be available on 7 December or not expected to be available on 7 December are in place. The source dependency from a firewall perspective, from passive DNS, from ICE.42:42Detection capabilities, ICE information excuse me, cloud and identity, we have some specific detection types that will, that still don't have a date for a plan and some network behavioral spikes. So the grouping is in these bullets here, AWS, Azure, and cloud resource anomaly.43:00Things like internal port scanner, remote control, protocol forgery and network anomalies just to name a few.43:21This is where the groupings of the remaining detections that still do not have a date available for release stand. For the detections, we are working as hard as possible to make sure that the cloud detections make it by the 7 December date as well as the network behavior.43:27Detections. We are very confident in telling you that the source dependent capabilities are not going to make it by 7 December, but please know that for the detections we are still working to have these available at the 7 December planned user interface shutdown date.43:48So we will update you on that, but until that time, please prepare to understand if those are or detections that you see in your environment in case you need to understand how to work around those being unavailable. Okay.44:08Next up is the fun one and, you know, the question on everyone's mind. So these are the planned detections that are going to be deprecated. These alerts will be excluded.44:30From XDR as we migrate over the detections as a whole, so group one today, group two, you'll probably see that all of this detection isn't in XDR, but you will still be able to see it in SCA.44:43Until the 7 December deprecation date. With that, this is even more so of me not reading you guys a word for word list, but there are plenty here. Again, it's AWS resource and active.45:00Anomalous workspace, exposed services from Azure firewall deleted. All listed detections again will be deprecated in one way shape or form on that December 7 December date, but still available in SCA till then.45:20The key takeaway though is that these alerts will not show up in XDR. Yep, NO problem. I mean, we've got others as well and this is us as a PM CX, XDR team.45:41I'm trying to be as forthcoming and transparent with you as possible.46:01That's why you got a huge list. But as we've been saying for most of this webinar, these are also in the guide. So please make sure you do check it. I was gonna say Danny, maybe you probably had this already up and and running, but since you're presenting, I'll I'll help.46:08We think through that here is.46:28The email that you should have received either in your day yesterday evening or your day early morning today, it's got our standard recap and review, a starting line, but it then highlights a CA to XDR detection release guide.46:31And it's very specific to the guide and what it includes. But when you click on that, you will see this guide come up and it has all of those details and very similarly formatted. Alerts moving, what happens when that alert moves?46:49On that date, the detections that are planned to release by 7 December, but that will with the date on those that have been deprecated and grouped very similarly as to what Danny is showing. If they're specific to AWS, Azure.47:06If they're shared across other source types, we are trying to keep this in the same model that we've been doing the cut over, so source oriented type of breakdowns, and then even things that are suspicious endpoint findings, network findings or user agent alerts from a category.47:22Perspective, and then the ones that we were just highlighting in groups, the detections planned with NO defined migration date and the telemetry sources planned with NO defined migration date. So as mentioned, this is a confidential document that's available through the link that you click, but you should have received this email.47:42Which references the guide probably as many times as we are in this webinar, great Danny, and you should reference that to get the full details and breakdown. Thank you.48:00Trying to steal my thunder. How dare you? Alrighty, guys, so 10 min left and again these are just more of the, you know, detections that are going to be deprecated. These are specifically around these suspicious endpoint findings.48:17Yeah the network user agent deprecation. Thank you for the heads up. I'm so used to sharing screen one. That one I shared screen two, I don't know what to do. All right.48:36So what should customers do now? And again, this is a section I definitely wanted to make sure we hit or the end of the webinar. As we've been alluding to throughout this webinar, check the sources, check the detections, check your response paths, AKA workflows. So match your alerts, use the guide that you.48:55Ryanna just shared.49:15You know, and review the alerts ensure that your business critical alerts, the ones that you are used to seeing, used to using have processes built around are there and if they're not, you know, identify them early so that you can put a workaround in place, verify your results.49:17So, you know, check your XDR activity, look at your detection findings, your incidents, and your, you know, any incident workflows.49:38That you might have set up, test delivery, we stressed it once, so i'll stress it again, alright, test your XDR workflow notifications, build it if you haven't refine it if you want to, especially now with the information that you have around the detections and utilizing the guide.49:46And knowing what to expect.50:06Clearer than even a month ago when we were just saying make sure you have a workflow for your notifications, at least now you can actually build around it and then keep your current settings in SCA. Don't go in there and start flipping buttons turning things on and off. I know that alerts page in the SCA.50:09UI is very tempting especially with all the toggles that you can play with, now is not the time for you to be playing with the toggles. Let's just leave those alone unless you really don't want your detections to be migrated over properly and or want to open yourself up to a potential vulnerability.50:28So I'm not sure if we do have any questions in the chat or the QA. However, based off of this session, these are some of the most common questions that, you know, we do expect.50:46So do all detections move 4 November? Nope. All right, we just covered that there's group one and group two. There's even a little mini group three for pre 7 December and then.51:03You know, be elusive group four or the TBD detections. Will every finding become an incident? No, right? Review your incident workflows.51:19Double check if you have any detection that auto promoted an SCA as an incident to XDR go look at it in XDR. If it's not toggled, puts a little toggle button. That's the only time I'll say it's ok to to push the toggle button is when you're in the XDR UI.51:35And then should you remove your SCA source settings or should you play around with them? No, keep them, keep them as is giving you as much information as possible, but again, playing with your settings at the current stage is.51:53Not advised and guys in closing, I do want to I did wanna save a few minutes just in case there were any other questions that came up, but we do have our.52:12A list of resources, those were in the email that Brianna had shared. Those are also here and they include the guide. So you should have everything you need and.52:28As the goal is for these webinars, there should be NO surprises on the customer's behalf. Yeah, thank you Danny. We don't have any questions. I'll maybe take another minute on behalf of the team.52:44To just highlight our guided up to operating model for you as we move through these final phases of the, the convergence shutdown deprecation.53:04Think XDR forward. So instead of operating out of secure cloud analytics user interface, think operating out of XDR user interface and what do I need to go back to the SCA user interface for? Especially after next week, a lot of the migrations will have been migrated, a lot were migrated today.53:20Danny Logan and myself watched it live as it was happening. So a lot of migrations, a lot of capabilities were moved over today for excuse me, a lot of detections were moved over today. But especially after next week there will be even more. So from this point forward, we really ask and encourage you so that you're as prepared as possible for the shutdown date. That's our goal.53:39All from from having been as transparent and, and hopefully as communicative as we have hoped to be is is what we.53:59They're hoping you have felt is that you're, you're ready to start moving in that model and you're ready for 7 December by 7 December unless you have unfortunately an impacted source, you should be in a state where you're ready to use XDR or maybe have been using it for two or three weeks and the shutdown of the interface for.54:08SCA will simply be a date and it won't really matter for your organization. That's our goal. So think XDR forward XDR 1st operating out of XDR, returning to secure cloud analytics where a detection has not yet been cut over.54:28It the majority of them should have been cut over for the source types and the type of detection that it would be. And then going backwards from there, understanding that the new detections are the ones that will show up in the XDR console that will contribute to incident correlation that will receive.54:43Notifications.55:03And you will have detection configuration available in XDR under administration in that setting. When a detection has been cut over, it will NO longer have notifications firing through webhooks in SCA. You will NO longer be able to manage that alert configuration setting in SCA.55:05It is locked for the next five weeks. It's only available to configure as its new peer.55:25XDR migration under the XDR console. The things that will continue in SCA for ease of operations verification and continuity until 7 December are all legacy SCA detections including the ones that have been deprecated.55:31And that will never move to XDR. They will continue to trigger and show an SCA only, but they will not be sent over as a detection to view in xdr's detection view, nor will they contribute to incident correlation. The only time a detection like that would show up in an incident.55:48In XDR is if in secure cloud analytics in its configuration, you had the auto promote option on.56:08We didn't turn that off so that it wasn't missed in, in the event that a detection needed to still be doing that until you could configure it in XTR. So those would still happen, but keep in mind they're operating out of the, the model we would hope for for you. They don't go through incident correlation.56:14And they would, they would bypass things like like the notifications unless you've set those up. And last but not least, those auto promote settings as communicated on our last few webinars are not migrated over because the detection logic is so different.56:33In most cases, from sca's backend to xdr's detection analysis, we don't wanna force those detections to auto promote to an incident. You may not want or need that to happen anymore. So if you do want that, you need to use the new incident tuning functionality that was released on 14 October to do so.56:49But we would highly encourage you to operate with the detections running through the incident correlation pipeline for a period of time.57:09Before you choose to do that. So if you're used to working out of alerts and you need to work out of detections, we understand that, please do that to continue your operations, but take the opportunity to take advantage of looking at whether or not incidents work better for you at this point in time to look at.57:18That was more than a minute, but it's the end to end thought on how to work as we move through these. We still don't see any questions, last call for questions with our last 30 s 60 s. Yeah, I'd say it was perfect timing. It is ten on the dot.57:35Nope, so I don't see anything in chat or QA. All right. Well, for those of you that it's lunchtime or afternoon tea time, we wish you a good, a good snack and lunch hopefully, if you can get to it. Thank you again for spending the time with us.57:55Peter, we'll pass it back to you for our final thoughts. Great, thank you Brianna and Danny and the whole team for bringing your knowledge to the Cisco community. Your feedback is important and at this time you'll be directed to our event survey. Please take a few minutes to participate and let us know how well you enjoyed the content today. Once again, we thank.58:12Everyone for joining and we'll see you next time.58:32