Cisco XDR

We use Cisco XDR to detect threats and correlate suspicious activities to identify threat actors and where these activities are in the MITR kill chain. We use it for forensics when initiating an incident response team in response to a threat. Our 24/7 SOC leverages it to have visibility.

I enjoy how well it integrates Cisco systems to provide a single pane of glass for security events that are easily digestible to the SOC. However there is room for improvement to integrate more seamlessly with non Cisco products. XDR is great to identify where malicious processes are in the MITR kill chain and is useful for threat analysis.

Cisco XDR is my SOC in a box. It simplifies integrations allowing me to have access to multiple streams of data in one place. We use it to enhance our security posture.

It caught and made us aware of some configuration changes that needed to take place, proving its value almost immediately

We use Cisco XDR solutions as the first line of device protection for our clients. Through Cisco XDR, we can manage and monitor devices and work proactively. In Brazil, the cost and integration of the solution with SIEM tools are still high, and other more affordable solutions compete in the market. Let me know if you'd like any refinements or adjustments!

As I mentioned earlier, in Brazil, the cost of addition is still expensive. Despite providing great visibility, there are other tools on the market with lower costs. The big advantage is the integration with the Cisco ecosystem.

The Umbrella offers, reduces operational complexities and eliminates the challenges of multiple vendors.

Cisco XDR is the main tool to manage security incidents and perform IR

Identifies all the Kill chain

To supplement my SIEM

Integrate with Cisco Secure Endpoint and identify lateral movement and C&C traffic

We use Cisco XDR as a central tool in our security platform for centralizing security monitoring and alerting. We have integrated it with about 15 different applications via the native integrations. For about the last 6 months it has been our primary tool for evaluating the impact of security incidents including ones we wouldn't have previously discovered.

It is well suited for environments that have a large mix of Cisco products and popular software packages. As a SaaS application it doesn't require much for a local footprint but at the same time won't work in an environment that requires your security tools to store data or run locally.