Integration · Topic 4 of 8
Cisco XDR for Security Investigations
Understand how Cisco XDR gathers telemetry from Secure Firewall and other tools, builds incidents, and supports investigation, enrichment and response.
- 4 min
- Cisco XDR is a cloud platform that correlates data from many security products.
- Secure Firewall sends events to the cloud through a connection set up in the FMC.
- XDR groups related detections into incidents and ranks them.
What it is
Cisco XDR is a cloud platform that brings security data from many products into one place for investigation.
A firewall sees traffic, an endpoint tool sees hosts, and an email tool sees messages. Each one alone shows only part of an attack. XDR joins them and presents the story as an incident.
Secure Firewall is one of the sources. It sends its events to the cloud, and XDR uses them with the rest.
How it works
XDR collects data, correlates it, helps the analyst investigate, and offers ways to respond.
Getting firewall data to XDR
The Secure Firewall Management Center (FMC) can send events to the Cisco cloud. You set up the connection in the FMC integration area, and you choose which kinds of events to send, such as intrusion events, file and malware events, or connection events.
The cloud then holds the events, and XDR can use them. The exact menu path and the available event types depend on the release.
Check that the FMC and the devices have the licences and the internet access this needs.
From events to incidents
XDR does not just list events. It correlates detections from different tools into an incident. An incident groups related events and shows the host, the user and the timeline.
Incidents are ranked, so that the most important ones appear first. XDR also relates events to known attacker techniques, which helps an analyst see what stage of an attack they are looking at.
Investigating
An analyst starts from an incident, or from an item such as an IP address, a domain or a file hash. Each item is called an observable.
XDR enriches observables with information from many sources. It shows what Cisco Talos and other intelligence say about it. It also shows which of your products have seen it, such as the firewall and the endpoint tool.
A relationship view shows how hosts, files and addresses link together. This helps you find the first affected host and the spread of the attack.
Responding
XDR can help with response as well as detection. Response actions can be run from the console on connected products. Examples are blocking an address on a firewall or isolating a host with the endpoint tool, depending on what is integrated.
Automation workflows can run these steps for you. A workflow can open a ticket, add an observable to a block list, or send a message, so that repeat tasks take less time.
Why it matters for the firewall
XDR makes firewall events more useful. A single intrusion event may mean little. The same event, joined with an endpoint detection on the same host, is a strong sign of an attack.
For the exam, remember the idea, not the clicks. The firewall is a data source and a place where response actions can take effect.
Comparing with the FMC
| Point | FMC | XDR |
|---|---|---|
| Scope | Firewalls it manages | Many products |
| Where it runs | On premises or virtual | Cloud |
| Main use | Policy and firewall events | Cross product investigation |
The two work together. The FMC still builds policy and deploys it. XDR is where you investigate across products.
What to remember for the exam
Seven facts cover the usual questions.
- Cisco XDR is a cloud platform that correlates data from many security products.
- Secure Firewall sends events to the cloud through a connection set up in the FMC.
- XDR groups related detections into incidents and ranks them.
- Observables such as addresses, domains and hashes are enriched with intelligence.
- A relationship view shows how hosts, files and addresses link together.
- Response actions and automation workflows can act on connected products.
- XDR does not replace the FMC, which still manages firewall policy.
When a question asks how to investigate an attack across the firewall, the endpoint and email in one place, the answer is XDR.
Common mistakes
These four mistakes are common with XDR.
Thinking XDR replaces the FMC. The FMC still builds and deploys firewall policy.
Sending no events. XDR can only use the data that the products send.
Judging an event alone. The value comes from joining several sources.
Forgetting licence and connectivity needs. The connection fails without them.
A response action can block traffic or isolate a host. Check the scope of any automatic action before you enable it.
Check yourself
Work through these three questions.
What does XDR build from related detections?
It builds an incident, which groups related events and shows the host, the user and the timeline.
What is an observable in XDR?
It is an item such as an IP address, a domain or a file hash that you can enrich and investigate.
Does XDR replace the FMC?
No. The FMC still manages firewall policy, and XDR is used to investigate across products.
Topic 4 of 8 in Integration
Test yourself on Integration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.