Unifying Cisco Secure Cloud Analytics & Cisco XDR: Roadmap update

I think everyone for joining today. We are very excited to share some updates on some of the updates some of the things we're we're heavily focused on within the XDR team.00:00Many of you probably in the past have seen our overall.00:20Goal of trying to converge our Cisco XDR experience and our secure cloud analytics experience. We've shared this in the past with some higher level outlines, but we're finally kind of on the, you know, core mission here and we'll have a much more specifics today about what's happening, what you can expect, timelines, and any actions.00:23Maybe to take.00:43So to jump right into that I'm actually gonna kick you off with just the outline and I'll dive into all this stuff later. Additionally add your questions as we said, I can I won't be able to get to all of them during this, but I'll I'll try to answer some at the end if we have time. But essentially, as we've talked about before on previous webinars and previous customer announcements.00:44The key, you know, secure cloud analytics core experience is moving into XDR and this will occur still over time. However, we have much clearer timelines and much clearer plans at this point in time to share. But this will really include what most of our customers use today, you know, 99 % of our customers, they're looking at our alerts, they're monitoring the detections coming from SCA.01:03They're investigating network traffic, cloud track, cloud telemetry, and exporting data. These are the key things we're focused on. How do we bring these into XDR?01:24We are starting this migration off off and running and hot. The, the network visibility module, which is actually, you know, one of the end X XDR features we we use SCA for to process that data.01:34That's the 1st one we're gonna start with. We're targeting 15 May already to move some of this stuff over to XDR. I'll explain what that all means in a minute. But it's really about, you know, notifying you of that being kind of our 1st lower or our 1st feature set, but this will continue on with all the other detections from NetFlow to cloud.01:49To all the other things we have in an SCA. So one of the key things to be aware of if you haven't activated XDR yet, it's part of entitlement with SCA for this reason that we are trying to converge these things together, you know, go ahead and activate it now and we can make the process easier if you haven't done that. Like most of our customers have, but we have still some who haven't.02:09We're focusing on the core alert workflow, so like keeping those same detections and greatly actually improving them. I'll talk about that the configurations we have for integration all the way through to exporting of data making sure that's available in XDR and then trying to actually improve the product in the process. We have, you know, a huge backlog of enhancements we've gotten over the years.02:30From security cloud analytics. We want to make sure we try to improve those core experiences, you know, not everything but the core experiences that where we've gotten the most feedback to make this product a better security product for you while we move it into XDR. So Cisco is making this change for some reasons. One.02:49We've been getting this feedback from our customers for years. There's, you know, a standalone product that doesn't really integrate with other products as effectively is less valuable especially a network detection product or cloud detection product. There's context needed outside of those detections, like who was the user, what happened on the endpoint?03:06This is a big benefit of trying to unify within our XDR product, you know, very strategically, it wasn't just, oh, we had XDR and security put them together. They're really complimentary and they also will build off of each other. But we we plan to really continue to expand that detection coverage. So it's not just about, you know, we're gonna ship all our focus into XDR.03:25Are with this process. We're gonna be heavily focused on reinventing some of the core SCA features so we can even improve detection and capabilities there, even if you're just using it as standalone detection.03:45And then lastly with the other benefits of XDR it's it's really about detection and investigation process. Improving that, adding context, you'll see some of the things we're doing at XDR, where this really plays nicely if you haven't already. So to kind of give you just a mental map of how these things come together, there's capabilities in the secure cloud analytics today and there's.03:58Abilities in XDR, and while they're very complimentary, we have different terminologies, we have slightly different workflows. We hope that are, you know, much more enhanced for you next year. And I wanted to give you just a visual of what are some of the different mappings. So in SCA today we have integrations.04:17And next year we have integrations and that's a pretty natural fit. Those two things will be on the same experience. The same integrations will exist in SCA today, so we, where we get data from today in particular, netflow, network on premise sensors, Meraki, the cloud integrations, those are all things we've.04:32Starting to bring in next DR and we'll continue to bring in next year in secure cloud analytics, I might refer to it as SCA and SCA for for short. We've got alerts and those alerts are built around the workflow alert management. You can export them, you can tune them.04:49You can configure them, you can assign them out, you can add comments to them. These, this in XDR is known as as an incident centric management workflow. So very similar in an XDR, you can manage incidents, you can.05:06Configure the incidents, you can get notifi notified of them and I'll talk a little bit about what's coming there to help bring some of the SC functions over and also improve S improve XDR around tuning configuration and how we can, you know, make sure your experience is like for like experience across these different terminologies and and hopefully greatly improved.05:21And then lastly, a lot of the key things around this overall, you know, alert workflow/incident workflow is, you know, the insight, the the things we can bring, so that's your asset inventory from the network, the asset inventory and next year that resolves with endpoints. The.05:41Workflows to get data out of the product. We need to get it somewhere else for your main workflow or for other, you know, systems you've built. The ability to actually configure the product to, you know, have the right inputs to get the right outputs. And then lastly, being able to investigate the actual, you know, raw data, like the network traffic, cloud logs, these.05:58They're all part of, you know, already existing experiences in next year that we're gonna merge these this into those experiences.06:17And then for something a double click into this, here's a, here's exactly where things are gonna land. So I won't read through all these, but I just want to kind of show you, you can look at this later. We've got sort of a mapping high level of concepts and we have a very deep dive mapping and also what we expect to improve. So just to call out a couple of the key, you know, key things we expect to.06:24You know, we're excited about that we're moving over for our around improvement. The alert workflow moving over to this detection findings viewer or incident view. This, this lets us do this correlations contextualization that we just haven't had, you know, in the previous SCA product. So if you integrate more data, we can correlate user device.06:44With the network alerts we're getting our cloud alerts we're getting along with other alerts from other sources. The other key highlights to call out, just a couple more I think that have been top of mind for secure cloud analytics customers in particular, the event viewer while it covers a lot of.07:03Specific, you know, telemetry performance for query has been a an area of focus for us as well as just being able to unify a query across all the data. So this is moving over to XDR investigate and we plan to really unify the search process across this data into a single viewer and also improve performance.07:22It's with the new pipeline.07:40And then along with that, the other big piece here is, the configuration in tuning. So much of the configuration we have in SCA today will will remain the same. So I, I need to set up subnets, but guess what? In setting up those subnets, e.g., not only can I do I have value that is gonna help me with.07:43Detections as input, like classifying inside versus outside networks, that's context we can now bring into the external incidents. So if you use exterior incidents to their full extent, you've now got where I have assets showing up, you know, that aren't.08:01Aren't deployed with an agent I can now start using that to scale up and down my prioritization of detection. No matter where the detection comes from, whether it's our own data detection or a non data detection. So there's gonna be, you know, synergies that really expand the experience for customers when it comes to what we bring over and, and what we should we expect to.08:14To to be much better.08:33And the last one I want to hit on here is, is tuning. One of the number one pieces of feedback I get as a PM is, hey, I want to be able to tune my NPM detections, my netflow detections more granularly, but as soon as the options good, it should be a lot better. So within XDR we plan to greatly expand the granularity of tuning through our incident tuning, and I'll show you what that's gonna look like.08:34Look in a, in a coming slide.08:54So some of the key benefits just to kind of recap what I just covered, it's unifying the workflows in XDR, so if you're XDR and XCA user today, obviously those are naturally better together, but really looking at it from the lens of where you have other touch points with secure cloud analytics in your environment, it's gonna help you even in that pro.08:58Process as well.09:17The investigation context, there's a bunch of new features in XDR and AI investigation that surface a lot of the, you know, evidence and things like that more closely, and I'll show you an example of that with just just SDA detections alone. So you can see that if you haven't seen that before. Great performance and time to detect. Huge focus for us. There's obviously.09:19The only so much we can always do when we get data from different sources like NetFlow, but we've got a lot of room to improve there and I'll talk about some of those specifics as well coming up. And then the granular treating is also what I I want to hit on.09:38So, let's dive into some more details so you can see specifics here and and hopefully get a better understanding of what's happening in some of the timelines as I get through that. So the 1st one I want to talk about, I talked earlier about alert, the alert workflow moving to the incident workflow.09:50So I wanted to give up just one example here of an example of some secure cloud analytics alerts that fired in one of our labs running an emulation, and what that looks like versus SCA today. So in SCA you'd get two different alerts in this case, one for.10:06A new external server and another for a cloud, some cloud activity. And in this case here you can see an XDR with our incident workflow, we've actually pulled this together into a single summary of visualization for starters, and second.10:24An actual reasoning. So we've, we kind of we kind of extract all of the data from the detections and we go query the netflow for you to pull the context, so instead of having to look in SCA at the alert with all the different observations, we go do all that for you and we kind of we summarize it.10:40So because because we actually have, you know, access to all the data with our AI agents now that run over the top on the incident level, we can do this for you and hopefully it'll save steps and time with trying to understand well why did this alert fire? What was all the context? The feedback so far has been, this has been really helpful. And you can see an example here where we extracted out the number of IPs, we extracted out at the beginning.10:57Behavior we saw again the detection fires, but.11:17This is the context that you can quickly see versus having to dig through all the data to to interpret. So it should help with just investigation and interpretation, even if you're just using the existing detections alone, it's gonna there's benefit. All right, so here's another major update. So I've kind of talked about this earlier.11:20This is the user experience migration. However, in this process, how are we gonna improve performance? How are we gonna improve efficacy, and how are we gonna make this a better product for our security cloud analytics capabilities today? It's through a process we're also doing in in the at the same time, which is shifting some of our pipelines and our analytics, you know.11:39Which today are already, you know, AI based to even a more modern approach.11:58So again, this will start with NVM, but we are sort of rebuilding every one of our analytics capabilities and ingestion stacks over to a newer pipeline and a newer analysis engine. So this is gonna allow us to enhance our stateful detections stateless detections.12:04Of which, you know, efficacy is is one of those areas of focus, like making sure we're not firing on common repeated activity that's well known in the environment, but really showing you the anomalies. Anomaly detection across our network detections in particular. So improving a lot of that visibility with more transparency in particular. So a lot of it's kind of hard to understand.12:21Stands sometimes from the feedback we hear, trying to make it more transparent, more clear when we break thresholds, what was the threshold difference. So you have a much clearer picture when it comes up to the, you know, visibility of the alert, why this alert fired.12:41On top of that, we're looking at, you know, we have a whole new capability where we can actually correlate detections, so we have different behaviors or different visibility things we see. It's not just correlation at the XDR level, but also individual like attack patterns sequences, things like that. So our our content development team mostly written written by Talos.12:54Today can continue to expand the tensive detections you're able to see with precision accuracy and relevance. With that, this allows us to.13:13You know, not only expand our coverage, so we're looking at, you know, in this process expanding our coverage, making our coverage more precise. We're also able to look at, you know, newer attacks like AI misuse, so if you have AI in your environment, how do we see AI protocols, AI processes, and trying to sort of bubble some of that stuff up as well in this process.13:23Lastly with this process, one of the areas of focus is improving time to detect. And in some cases, for especially for our network detections, we we've seen with this, you know, pocs and the new new engines here, up to an 80 % reduction in time to detect. So substantial from where we're at today.13:44And where we're, you know, hoping to get to with this engine.14:03What this is gonna actually look and feel like to you as a customer is a couple things here. So these are real screenshots from real environment, so it's working, we haven't, again, we're not deploying the customers, but for MVM to start, we are in the XDR investigate process building out an activity here.14:09And this activity viewer is gonna surface all of our different sources of activities. So these would be NVM flow, netflow, cloud logs, and the goal is to have it all in one view. So one tab here that you can actually filter and search across. So you're not having to go to the individual tabs seeing next DR.14:24And on top of this, it's built on a much more performant data architecture, so the search is substantially much quicker. So here's a view of what looks like for NVM. I'll talk about what this means for the cut over in a minute. Additionally, we've got the native detection experience, so around configuration.14:40So this should look very familiar to customers who have used the one in, in, but in XDR we're gonna have a screen here that's gonna be somewhere on the left navigation where you can just go configure detections here and again 1st NVM will will start showing up here, but all detections will be available eventually in this list, as well as anything else new we may add from.14:57NVM. What this will let you do is is two different things with NVM to start. It may look the same here, but it's gonna be hopefully a net new improvement. So for starters, we've got these two flags here. We've got enabled and we've got promote incident.15:17And what these will do today is essentially in SCA today, they they turn them on as alerts today. Enable does, and today in SCA as well for which incident just automatically triggers an incident when the alert fires. These are changing as we move this over. So we will we will migrate your configurations over, by the way, in this process.15:34Automatically, but.15:54The enabled button here in SCA will here in XDR now will actually just say, ok, the alert's on, it's gonna show up in the findings viewer. And it's also going to be automatically included in an incident correlation analysis, so if I see the alert fire, we'll automatically correlate it. The big benefit to customers.15:55Is for those who really want to promote an individual alert as an incident, this little checkbox here will do the same a similar thing like it does today in XDR, where it'll actually promote an incident. However, this will go through the full analysis pipeline automatically and anything new that comes in will get correlated automatically. It'll go through the agenic analysis, so all of.16:14It's it's a much more native, you know, correlation experience than what's exists today. So that's getting deprecated the old experience, but it's gonna get greatly enhanced as this gets brought over to this new configuration page.16:34So again, much better much bigger than UX, it's a full pipeline. And then lastly, this is just a mock up. This isn't the actual working page yet. This will change, but I wanted to give you a preview into it because today in SCA we have alerts snoozing. For NVM in particular, this isn't very effective because you can't snooze on process. However, we want to be able.16:44To add this level of granularity into XDR and at the incident level, if you don't want to ever see a detection with a certain criteria like this process or this process path or this external IP address I trust, we're gonna give you the granular flexibility to go into an individual tuning rule and add in the different properties you wanna filter out by.17:04As a later phase of this, we expect this to be brought into the overall incident workflow where we're gonna actually propose tuning rules. So you'll see rules show up as, hey, this is you close it as a false positive before, here's the rule you should add, right? Following best practice for tuning rules, which are typically time based rules.17:24So another big improvement for SA customers, again, this isn't fully there yet, but I wanted to let everyone know this is one of the big drivers of this function is improving the SCA tuning VPs, which has been a major piece of feedback. And then lastly, one of the big items here is.17:42Data export. So we know in secure cloud analytics, the export of data is very important for many of our customers, whether that's notifications via email or actual true export of all the actual activities or SCA may not be your main point of monitoring. And we wanted to make sure next XDR we we have that same.17:58Option. So again, given we're not just moving the, the, you know, the UX over, we're actually redoing the entire engine. This is gonna change how some you have some action items here we we need to take. So for NVM in particular to start with that 15 May that I called the earlier in mind, I'll i'll hit on them again.18:17There's a new workflow capability that's nearly available, it's available now in XDR that's gonna let us do a lot of the same functions we have in XDA today in XDR through our workflow function. And we hope it'll also be better. Here's why we moved over in XDR to open.18:37Cybersecurity schema framework OCSF, which one of the challenges in SDA today is you've got all these different observations, you've got these alerts, you gotta start mapping all these things together in the APIs to get the right data. XDR, it's using OCSF, so we've already standardized on a framework that's much more well known. It's got more robust context, all in the same alert package or findings packages.18:54What they're called now and this is gonna let you get a lot more from an individual, you know, API versus all the stitching you have to do to put the whole story together like you do in SCA today at a very custom way.19:14Additionally, for those other engines in the future, we're gonna migrate like NetFlow and cloud, you can actually do this today cause we already send all of our data over to XDR, turn to OCSF. So if you start configuring this process today for all of your exports of data.19:24You it'll just work once we migrate the engines and you won't have to do anything. So you can start the process today and it'll, as we move those engines over to XDR, the user experience will move over, but the workflows and stuff exporting the data will just keep operating. So it'll that's the beauty of what we're doing here.19:40So we realized there's a little bit of work here and there's some, you know, work on the customer side for if you're using these functions, but there should be a benefit of of the framework that's more open as well as other benefits in XDR where you can export more data that we don't even have, like incidents, stuff like that.19:55And there is a devnet guide here as well that's already posted. We'll we'll definitely send this out later, but we tried to make this a little bit, you know, it more simple for you to actually follow a Cisco standard process here. Okay I'm gonna jump into some timelines here shortly, but I wanted to cover a couple things. So there are functions in SC we will deprecate.20:12A lot of this that we've we've analyzed has been from utilization or expired features. So here's the list, the short list of what we've identified as things we're not gonna carry to XDR. So the 1st one is the cloud posture watch list. While we'll have visibility to all the logs in in in XDR, like we're gonna bring the same cloud logs over to XDR and we're gonna.20:33To have you know some of the watch lists and stuff in XDR. The cloud posture watch list uses an outdated set of benchmarks.20:52They're about five years old today and we realized this is now something we're gonna support going forward, so it's not ideal to be using this today. While people have configured and turned it on, we already suggest not using it just because they're five year old benchmarks, they're not there that have been updated by AWS and others CIS. So we're not gonna bring this over to XDR. If you're, if you're using it today, you can, you know.20:58Turn it off today if you want to, I just wanted to let you know that this particular piece won't be brought over just because it's hasn't been updated now for, for several years.21:18Same with Kubernetes, we actually have NO customers. I think all the internal portals on this, but wanted to make people aware, don't go deploy this. It takes it's it's a similar function that in the cloud you can go deploy our agent. That's another one where nobody, we see nobody use it, but wanted to call it out. And then the AWS visualization and some of the dashboards in SCA.21:26We expect some of these to change in XDR, so e.g., as we move over, you know, all of our AWS assets into XDR, they'll they'll show up under the asset insights inventory. So we're gonna have visualizations and understandings of the inventory from the cloud, from the network. It's just we're not gonna port the exact reports over to show some of this stuff and we'll be focusing on.21:45Building out reports in XDR and visualizing the data that way. In XDR terminologies, not in SDA terminologies.22:05And then lastly, there's other integrations like we have like Meraki and Umbrella that have already been brought into XDR. We'll just use the XDR integration for that. We don't have to go, we won't use the legacy integration in SCA. And then the last call out here is around email. So we have notifications in XDR today. They're a little bit different. So e.g. you can get an email for every sing.22:12No incident which are are supposed to be, you know, less and less of a, of an occurrence if, if we do our job right.22:32We don't have any formal plans yet for how we're gonna do some sort of like an email report or status report or daily email alert summaries, but there are notification options you'll see in the, in the guides for XDR to migrate notifications over. If you still want to get notifications of alerts detections, et cetera. So just the actual reports and and that function will.22:40Will change but it will still be available.22:59Okay, so let's talk through timelines and what this actually means, you know, just to give you a deep dive into MVM in particular, I think it'll be helpful. So we're targeting 15 May for MVM, you saw this email communication that went out and what this essentially means is we're gonna move the detection engine, the detections.23:02And a lot of those key configuration items from SCA for MVM over to XDR. So this will all happen automatically. We're, again, we're gonna do this for customers. If you have settings, we're gonna bring those over for you. There's not anything you really have to do unless you're using those webhooks today. That's the main action item.23:21We're targeting again this is targeting. We'll, we'll provide more updates with specific dates going forward, but we're targeting roughly three months from now. Hopefully it might be a little bit longer, but trying to make sure you're all aware of how quickly we're trying to make things happen. The network and netflow detection is being next, which means we're, we're we've got a new anomaly engine that's being.23:39We've built, we've got a new set of detections being built for netflow. A lot of it's gonna be taking what we have today and bring it over and also adding net new. As well as some of the additional configurations that exist in SCA today, like subnet configuration is a big one, the watch list over into XDR.23:59So again, three months is probably a little bit, you know, it's probably a little bit hopeful, but I want to make sure we're all aware this is happening quickly and just to give you a heads up. Followed by that we'll focus on cloud detections as the next follow on milestone. And again, we're doing this in milestones just because we know we have customers using webhooks, we want to give enough heads up.24:14And two, we want to make sure people have time to get into the XDR experience, understand it if they haven't yet, and.24:34Three, it's about ensuring those engines all move over and are actually much better than we expected from the SCA engines and everything successful, so it's a big, you know, big migration. One important note here, and I'll call this out again, if you set up integrations to make these detections work.24:39We're gonna, you don't have to go do anything like it's we're gonna keep feeding the data through that way, that mechanism. The new integrations, well, we we may move those integrations over next year. I'll cover that in a minute. But what you have set up today, you don't have to go reconfigure all your Azure, all your IPS, all your sensors. Don't worry about that. We know how much work that is.24:55This is just the detection engines kind of moving and, and whatnot, and we'll still feed data through that pipeline. So what this is gonna look like for NVM, just to give you a very specific example and details, the actual, you know, cutover date again targeted 15 May, the new NVM engines are actually kind of on already, we're actually feeding data, so trust us it's working, we're.25:13I'm just gonna test it out with you last minute, but we haven't exposed it to customers yet just to make sure everything's working, going through our QA, going through our efficacy testing. But for customers, these will actually turn on.25:33And you'll see them in the user experience and all the data flowing out if you set up the the workflows targeting 15 May. So we'll have a brief period where this turns on. There'll, there'll be a migration validation just to make sure everything looks good. However, you like they're likely, you know, this will be a very, very brief period. And then what we'll do is we'll start turning off.25:45You you won't see this stuff show up in SD anymore. So anything new for NVM won't show up in the alert list anymore. It just be an XDR findings or XDR incidents. The this the thing that'll also go away is the configuration page, so you won't be able to configure NVM detections in the alert list. That'll go into XDR right away and you won't just, you just won't see it anymore. Existing.26:03Detections will still be in the, you know, alert list. It'll still be in XDR by the way cause we're already feeding the stuff in today. So you'll have a single source of record or single source of truth in XDR findings viewer. If you really want to see everything at once, it should look, you know, like things are just working, right? It's not gonna seem like it much change. If in SCA, you won't, you won't see the alerts show up anymore. So that's why that webhook migration too.26:23The workflow is so important if you're exporting data and getting notifications.26:43The other piece of it is around integrations. So I wanted to just call this out. Again, like I said earlier, if you've got integration set up, we understand, you know, we're not gonna make you go reconfigure things in XDR to the best of our abilities. So what this will look like is we, we are gonna migrate the actual UX of the confi.26:50Configurations over to XDR and hopefully make it a little bit better where we can like adding in some scripts for Amazon or Azure we have, we have scaling, you know, needs.27:06But what this will look like is it's going to be a new screen in XDR and there's gonna be a process that we have to do to sort of support, you know, making sure you can see your existing integrations in some form where that you've already set up. New integrations, you'll have to use the XDR process. So you have to go into the XDR screen, configure the new integration.27:14For Azure, AWS, network sensors, et cetera, but.27:34We're still kind of working through the exacts of that. We just understand customers, you know, don't want to go through and reset things up again. Unclear. We've heard that already, so we will make sure that process is as smooth as we can. Make it. All right, so I'll stop i'll stop here. This is kind of the overall outline.27:37I'm going to, you're gonna be getting a lot more communication from us. You're gonna be hearing a lot more on specific dates. There's, there's a lot more help being posted already on the community site. We've got TAC, you know, help, we've got CX help. So there's gonna be a lot more coming from us here, but I wanted to make sure we gave you all just a.27:55Clear picture of our plan for the 1st time. You saw the email, you had more detail here. If you, the the key things though is is activate XDR if you have not done so, so if you're one of those SCA customers, you're entitled to XDR, this is our path to really bring our SE product to the next level and and converge with XDR. We've tried to make it easy for our XCA customers to do.28:13So, even when it comes time to like renew and things like that, you know, while licensing is different in XDR, we've we've been working with our customers on this already.28:33The export notifications thing for if you're an MDM customer in particular, you know, 15 May, that's our target to move that over. There aren't many customers using those who are just in VM, but you could actually do this again for all detections already cause they're already flowing into next DR. So if you have XDR configured with SCA.28:41Start now, you get the benefit of the of OCSF and it'll just work for you as we move these engines over. And lastly there's an FAQ migration guide, these are all in the email. We'll have links to this, and we're we're of course happy to answer any questions as we go during this process and work with our customers to make it as seamless as possible, but I'll just leave it at.28:57We're very excited about this change, especially for a lot of the things in SCA, for me as a PM I've been wanting to do and make better for our customers, we get the chance to do now with XDR.29:17So with that, I'm gonna jump over some questions Laura and just see what we've got. If you look Logan, I've got some questions for you. So will the current state of classification come over or will new stacks reclassify the endpoints?29:26Yeah, so that would be I'm guessing we're talking about like the role classification so in that case yes, there'll be a, a similar form of that brought over because it's required for our detections. We expect that to sort of.29:43Do two things. If you already have noticed if for those of you using XDR in our genic architecture, which is very new, this is now open beta, we already starting to use some of this stuff in that. And you probably saw in my previous example over here, we had a Kerberos, you know, node. We're starting to use some of those classifications in incident analysis. We use it in detections, so it'll get.29:59Over into the asset insights feature and it's already something we're already we're already able to query even without.30:19The stuff being brought over from that analysis. So it's gonna be a critical source going forward as well. It might, we might, you know, tweak some things to improve classification as well in the process like I talked about with these new engines, but the concept will live on. Okay, and then the next question is, will the detection config get.30:24An option to select groups like all for NVM or firewall et cetera.30:44Yeah, so what if you look over kind of on the exact page here, I'll just jump back to it briefly. Sorry, wrong one, there we go. On this page in particular.30:50The detection thing, you'll be able to sort by telemetry source. So I think the question is, are we, are we able to change things in bulk? Not at this moment, we haven't planned that, but that's a good feature. I'll make sure I add that we'll record that one. We haven't, yeah, we didn't.31:06I I'm not sure if like you can do everything at once up here like you could before with like select all enable all, promote all. But that's not, that's currently not, this is actually working software again right now what you're seeing in in a real environment, so I'll I'll add that one as a one of our items to track. Good, good call.31:24Okay, and then will rule configuration have the option to do a CSV export for ITIL logging? Yeah, so with the export of data?31:40This is very granular. You can, it's a lot more flexible than SCA is today with just the web hooks with the workflow automation feature. There's a limit, you know, a unlimited number of things you could do custom in terms of export sources. We'll have Cisco managed workflows I forgot to mention that for some of the sources on the left here to make it really easy for you, just turn on. Those are tax supported by the way, but.31:55There's really a limited number of things you could do to export detection findings or anything from XDR, from incidents et cetera, to whatever log source you may need to log it in.32:15Okay, and then anything to help with overlapping IP addresses, customers reporting that they have two devices with the same IP, some are on connected networks, but they're currently being stacked in the alerts. Yes. So a couple of things we're doing there. It it.32:25The the short answer is it depends on what, what kind of data you're giving us in terms of integrations. If it's Meraki customers in particular, we're looking at how do we get more from the Rocky data to really make those kinds of clarifications like network IDs, things like that. So the answer is yes, that's a high priority.32:43Enhancement for us even outside of this whole migration. However, what we're also looking to do, as we bring over the SCA device context, so the profiling, the device page, we are looking at how do we reconcile that with.33:01Assets in XDR today that that build up from identity, endpoint sources, those kinds of things. And part of that is looking at what other contexts can we bring in to better identify network asset. So it's a, we now kind of have the leg up, which is we have more context in XDR than we did in SCA for asset info information.33:17What we're still missing though is, you know, sometimes we're missing the the connecting dots, right? So we can do things like time based correlation. These are all things we're talking about and looking at now with XDR just to, to make sure the asset inventory in XDR can be reconciled with the network inventory we bring over our cloud inventory. So.33:37Long answer or short answer is yes. The long answer is this really depends on the situation we're doing our best with each, you know, different deployment situations we have to deal with. On top of that, we've had requests you know in the past for things like ipam and other integrations. These are things we haven't quite explored yet next year, but they're certainly on the radar and as we look to even.33:56Further our offered within the overall Splunk ecosystem in XDR and Cisco.34:16How do we bring this inventory in and and context into the best of our abilities because we know it's important for customers is a is a radar item I should say. And then for customers who are getting ready to deploy AWS and other things like that, they should go ahead and follow the process to do that now and then.34:20As part of this migration, all of those will be moved over for them, correct?34:40Yeah, so what we have on the truck today for integrations is as follows, use what we have on the truck. So if like we haven't moved AWS or Azure over to the XDR portal yet for integration, do it in XDR. We're gonna use the we're gonna use that configuration, we're gonna use that ingestion mechanism in XDR. The engine will move.34:44You'll see different detections.35:04But yes, the the path is the path until we actually have the one in next year ok and then someone asked that the role classification will continue, but will the specific current role classifications be exported or do they need to be reclassified from scratch?35:07That's a good question. I don't have the full answer to that other than there are as as we look at flipping slides around, but as we look at this overall rethinking of our detection engine.35:28The specific I think I understand it. So I just I don't have the specific answer other than when we focus on this enhanced anomaly and behavioral detection engine in particular on NetFlow, part of that is actually looking at.35:45Role classification. In order to get those detections right, we've got to make sure we can classify an asset properly. So the short answer is yes, they'll probably be rethought to some extent and are being rethought right now. I just don't have the specifics on how the mapping will go and what will remain and what will get moved. Certainly I've seen feedback in the past of, you know.35:59Classification is not always being perfect. It's more about profiling and understanding the device but yeah can lots of issues Yes. So it's I certainly seen that in the past where customers have given me the same the same feedback where the issues, given we only have so much network context, it's been it's not always a hundred percent accurate, right? In certain cases it is like the main.36:18Controllers i've seen in many cases be accurate even even in real incidents, but.36:38Certainly, there's a lot of room for improvement and that that's gonna get rethought as we look at this whole foundation kind of shift and again already is being rethought. Okay, and then any news on modernized ONA sensor or telemetry broker integrations or an upcoming infrastructure sensor to get flows into XDR?36:43Yep. So the reason I have Netflix network sensors a little bit later on the plant here is purely for that reason. So everything on the truck today, you know, is something we're gonna have to support for however long the customer exists in those areas like ONA and CTB, which can be deployed today are.37:03Our plans are to continue to support those in this process, so bringing those into XDR, but we are working with our extended teams in, you know, formerly have been focused on CTB and whatever that becomes as sort of our, you know, cloud managed sensor going forward. We are working with those teams right now to plan out the roadmap with.37:19Some more specific timelines on how do we get to a more unified sensor across Cisco even if you have multiple Cisco products, while still maintaining support for those existing sensors, we know that the CTB e.g. is not optimal because it's not cloud managed. It's more cumbersome to deploy than ONA, so we're trying to reconcile to pick a single solution going forward.37:40But again, if you've deployed something, it's something we're gonna support in this process in particular. Okay, we had a question about being able to monitor the sensor status in XDR. It says it's currently we're not able to monitor it. So will there be an improved dashboard for that so that we can monitor the health of those on premises sensors?37:59Yes, and that'll come with this, this migration phase. As we migrate the actual sensors over, it's it's not just getting the data into the sensors, but it's also the actual health reporting status. Where, where do I go to see all that, that, that'll get brought into XDR at this.38:19At this later phase, and again I don't know the exact dates on this because we've been so focused on the other piece, but this is some of the sequencing I want to make sure everyone had today. It's just how we're going iteratively through this process. Will there be a custom detection feature based on NVM or EVM data plant?38:34So, couple things on that, one, the frameworks I I shared earlier here are much more scalable to being, to putting something like that into the wild because of how we're building things for customers. Right now the content developers are Talos and that's where we're gonna be focused.38:54But, there's kind of two fronts to that. So one would be exposing one would be exposing the same kind of things we can do internally to customers. That is not necessarily in our plans at this point, but we know that there's certainly been requests for that.39:13The part that is in the plan is, is the tuning piece like I talked about, more granular tuning for suppression and promotion to incidents. So when we do have detections and alerts coming in, we can control those much more effectively, but what we want to see. So this is where we're gonna focus 1st on that initiative. The, the custom detection piece.39:29Now we're we're working through how do we, how do we bet how would we best do that especially in a world where we're working closer with Splunk as an XDR product to make sure customers aren't kind of given the whole, the whole gamut of things and it's done in the best way possible, so NO clear plan yet on that piece of it other than the framework allow itself would allow for that more effectively.39:49Alright, and then we got a question in Q and A Will there be any more integrations with MS Defender? Yeah, so a couple things on defender. To start, we.40:09We've recently opened up one of the most common requests I've heard, which is the Defender for identity with our custom security event ingestion workflow. So if you have that product, you can now integrate that through that, that ingestion workflow, just like you can Cisco identity intelligence.40:24That's the, sorry guys, I was like, I thought I hit pop UPS that that's where, that's where you can do that right today. So other defender products like there I think it was like a web security one. We don't have anything direct for that yet, but identity has been the next best.40:42You know, ask. On top of that, when we look at what comes from Defender today, Defender for Endpoint in particular, this particular function here around tuning as well as the agenc analysis are areas where we look to expand what you can actually present as an incident should you want to present more as incidents.40:59From the, from the existing integrations, ok? And then will there be an SCC integration or is that being not done anymore? It's still in our, in our plans. The, the goal.41:19You know, the goal we still have within XDR and that includes bringing SCA and is trying to unify around a single Cisco point for getting to everything from Cisco. The specific timelines of that we we started on the, the role based, we started on the the more granular, you know, identity or access being the 1st piece.41:34How we bring in the products into Cisco security cloud control is still being worked on with that team of, you know, what from XDR would fit in. So NO NO timelines on that other than directionally that's still a direction Cisco in general wants wants everyone to focus on.41:52For the best of our customers. And then I think the last question in the chat is, is there going to be a CVM replacement? Yeah, so a couple things on that not that I'm aware of a direct replacement for CBM. However, when it comes to vulnerability context.42:10This is.42:29A focus for us on the XDR asset insights component. So when we look at where where can we get vulnerability data from? We have products like Orbital now part of XDR, we have Cisco secure endpoint. We potentially have other sources outside of that. And as we look to work with Splunk more, we have even more sources. So we know vulnerability context is important for investigation and.42:31Particular, that's the that's the theme we're gonna focus on going forward without, you know, I I actually myself don't have the specifics on exactly what their about looks like, but we can always provide that as a later update.42:51Of the but it just know it's yeah vulnerability is important, we know that let's see, are there any planned integrations for rapid seven for vulnerability? Okay, so that's good follow under that. Nothing's difficult with rapid seven other than what I just mentioned around the the vulnerability.43:03Context being, you know, something that's we understand is useful when it comes to asset context and even, even as we look at the agentic analysis, We've on next year we know and that we know the feedback there has been strong around, hey, if I could see some vulnerability context around this asset, it may not be a direct link, but it's at least useful. So that feedback's been taken and we've tracked it.43:21And then a follow up question about Defender for identity. It said how can we integrate this for correlation? Yeah, so follow the there's a guide now posted. If you go into XDR, which I if I had it up like without i'd pull it up right now. If you go into XDR, go to the workflows section.43:42You'll see create new workflow.44:02And there'll be one for identity, follow those steps there and you should be off to the races with getting it integrated through correlation. Alright, I think that's all of the questions. So if anyone else has any other questions, please let us know real quick.44:04Yeah, ask Logan anything because it's yeah while he got him here. And like I said, we're we're gonna have more touch points going forward. We have more emails, there's gonna be there there will be more times to engage with Cisco and this going forward as we go this to help you. It's not like this is the webinar and then just start seeing stuff come.44:24The communication process is we've got a whole plan with our team here on our CX side to to make sure this is.44:44Well communicated and updated. Well, I I thank you all for the the time today. Just one note I didn't mention earlier I wanted to call out. So on the overall migration of detections, you know, with all those new engines and everything.44:50There will be as we move NBM over a substantial increase in detections as we move things over because we've been building new detections up in the background on this new engine. So in addition to just migrating stuff over, that when we move these things together, there'll also be an increase in coverage on, you know, over over the course of the period of when that goes live. So it'll.45:06Probably get released in batches, but we've already been testing things out and, and Talos has been hard at work there. So I think that's that's important to note. You know, you're gonna see things, you're gonna see hopefully a lot more benefit in this process and I forgot to mention that key benefit of just more coverage will be coming ASAP with MVM e.g..45:26There was one more question. Are there planned AI defense integrations to extend kill chain visibility, storyboards, et cetera? Yeah, AI defense has definitely been a topic for us internally. So in addition to like the the AI topic I talked about with our existing visibility surface from MDM.45:46In particular, their Cisco with cisco's AI defense yes we've had that one. I don't have the exact plans on the planned integration route for that, but certainly it's been brought up as a topic for us internally just given it's getting rolled out to customers now more readily.46:05And then, they're also looking if there's a way to create an incident whenever you see an isolated computer in AMP. Yeah, so couple things on that one that.46:23That workflow we're building out around tuning is gonna be a workflow to use for that. But what that requires is us to, which we're working on right now, bringing those isolation events over from index DR today. So that's a that's a key focus for us at this point is bringing some of these retrospective analysis events in particular in.46:38That that would need to show up in the XDR findings so that you could then trigger that. So short answer is yes. Long answer is long answer is that there's a bunch of stuff we have to do to get to get there that we're working on.46:59Alright, well, I appreciate everyone's time and and sitting through all this and all the questions, great questions. Look forward to come to us. We're happy to help you at Cisco with different questions. We know this is a big change, but we hope it's gonna be a net positive for all of our customers and even those who use.47:20Use today, you know, day to day. A lot of this was designed with improving those those key pieces of feedback we've heard from our customers in mind as we go through the process. And yeah, if anybody has any last minute questions, feel free to drop them in the chat real quick. Otherwise, just a reminder, we will.47:36We'll be sending out the recording after this wraps up along with any resources that were discussed. Please keep an eye on your inbox. There will be communications from Cisco coming out about the convergence. And if you have any questions, please feel free to reach out to your CS CSS representative and we'll take care of anything as as quickly as possib.47:55Once again, thank you so much for attending. Ash and Logan. Wonderful job explaining everything and answering all the questions. And yes, thank you for your time and have an ethic day. Thank you, Steve.48:17