Cisco Threat Response

Security that works together

Don't clone your security team--get Cisco Threat Response instead. Threat Response automates integrations across select Cisco Security products and accelerates key security operations functions: detection, investigation, and remediation. It is a key pillar of our integrated security architecture.

Get more value from your Cisco Security investment when the products work together to save you time and manual effort--especially when you are under attack and time matters most.

Hunt for the riskiest 1% of threats. Cisco Endpoint Security can help you go from exposed to empowered in seconds.

Benefits of Cisco Threat Response

Unleash the full power of our integrated security architecture with Cisco Threat Response.

Out-of-box integrations

Get more from your Cisco Security investments when they are already working together.

Designed for your SOC

Reduce the burden on your other security products and make them work better.

Save time and effort

Speed cyber investigations significantly and take corrective action immediately.

No additional cost

Get it today with integrated Cisco Security product licenses.

Key features

Aggregated threat intelligence

Cisco Threat Response integrates threat intelligence from Cisco Talos and third-party sources to automatically research indicators of compromise (IOCs) and confirm threats quickly.

Automated enrichment

Cisco Threat Response adds context from integrated Cisco Security products automatically so you know instantly which of your systems was targeted and how.

Intuitive, interactive visualizations

Cisco Threat Response shows your results on intuitive, configurable graphs for better situational awareness and quick conclusions.

Incident tracking

Cisco Threat Response provides the capability you need to collect and store key investigation information, and to manage and document your progress and findings.

Seamless drill-down

Cisco Threat Response makes it easy to continue deeper investigations into integrated Cisco Security products. Want to see exactly where that malicious file went? One click and you are inside Cisco AMP for Endpoints with everything you need to know about its trajectory.

Direct remediation

Cisco Threat Response lets you take corrective action directly from its interface. Block suspicious files, domains, and more--without having to log in to another product first.

Try now

1. Just log in

Use your AMP for Endpoints admin credentials or Threat Grid Cloud credentials to log in now. Have Umbrella or Email Security? Your access is coming very soon.

2. Enable modules

Just one simple configuration step turns on the integrations which today are AMP for Endpoints, Threat Grid, Umbrella, and Email Security. But that’s just the start.

3. Start investigating

Cisco Talos Weekly Threat Roundup is a great place to learn about the latest threats. Just paste the indicators of compromise (IOCs) into Threat Response, and prepare to be wowed.

Resources, demos, and webinars

In the SOC

Do you need more experts like Kareem in your security operations center too? You bet. But in case you can’t find them...


Let us surprise you with what Cisco Threat Response can do. Here are two must-see videos to explain what it's all about and why you need it.

ThreatWise TV

How about an engaging interview and demonstration of Cisco Threat Response led by our very own Jason Wright?

Upcoming webinars

Join our March 14 webinar to see how you can quickly stop threats by integrating your Cisco security products using Cisco Threat Response. 

What the experts are saying

4 reasons to choose Cisco Security

Cisco is making security simpler and more effective. Learn about our newest innovations.  

Email security integration

Read our blog to learn how Threat Response integrates with Cisco Email Security for faster detection.

Open source integrations

Check out the Threat Response open-source integrations you can use to improve your security posture today.

Key integrations

Cisco AMP for Endpoints

Want to know which systems were affected by that malicious file? Integrate AMP for Endpoints with Threat Response and you’ll spot them right away... and then be able to secure them.

Cisco Umbrella

Need to know which devices connected to that malicious domain? Integrate Umbrella with Threat Response and you’ll see that too... and be able to block those domains.

Cisco Firepower

Wonder which alerts are the most critical to investigate? Integrate Firepower NGFW/NGIPS with Threat Response and you’ll get those high-fidelity events.

Cisco Email Security

Want to find out who sent that malicious email attachment? Integrate Email Security with Threat Response and you’ll find out everyone who sent it and so much more.

Cisco Threat Grid

Curious if anyone else has seen that file and knows why it is suspicious? Integrate Threat Grid with Threat Response and get detailed intelligence about malware, associated paths, and more.

Third-party integrations

Does Threat Response work with anything else? Integrate other security products and threat intelligence feeds with Threat Response through its robust APIs. It’s not always about Cisco.


Incident Response Services

An effective security operations center is not just about great technology. It’s about how your people, processes, and technology work together to identify threats and swiftly take corrective action. Let Cisco Incident Response Services help you prepare for, manage, and recover from network attacks and data breaches.