Network Access, Visibility, and Enforcement · Topic 5 of 6
XDR, SIEM and SOAR with Cisco XDR and Splunk
Describe visibility and enforcement with telemetry, AI and ML, XDR, SIEM and SOAR, and how Cisco XDR and Splunk manage and automate security events.
- 5 min
- SIEM collects and correlates logs, and gives search and compliance reporting.
- XDR correlates across security tools, and offers built in response actions.
- SOAR automates response with playbooks.
What it is
XDR, SIEM and SOAR are the platforms that collect security data, find the real incidents and automate the response.
Security tools produce huge numbers of alerts. Humans cannot read them all. These platforms gather the data, use rules and machine learning to find what matters, and run actions automatically.
How it works
Learn what each platform is for, then see how the two main products fit.
Telemetry for visibility
Visibility starts with data. The main sources are:
- Network: flow records, DNS logs, firewall events and packet metadata.
- Endpoint: process, file and login activity.
- Identity: authentication events and access decisions.
- Email and web: message verdicts and web requests.
- Cloud: audit logs and workload flows.
Enforcement follows visibility. Once a detection is made, the platform can trigger an action, such as blocking an address on a firewall or isolating an endpoint.
Native AI and machine learning
Machine learning helps in several ways.
| Use | What it does |
|---|---|
| Behaviour baselines | Learns normal behaviour of a host or user and flags deviations |
| Anomaly detection | Finds unusual volumes, destinations and timing |
| Correlation and prioritisation | Groups related alerts into one incident and ranks it |
| Entity risk scoring | Raises the risk of a user or host as suspicious events add up |
| Encrypted traffic analysis | Spots malware patterns in encrypted flows from metadata |
Cisco Secure Network Analytics uses flow data and behavioural modelling to find activity such as scanning and data hoarding. AI assistants can also summarise incidents and suggest next steps in plain language. Machine learning can give false positives, so analysts review the results.
SIEM
A security information and event management (SIEM) system collects logs from many sources, normalises them, stores them and searches them. It correlates events with rules, raises alerts and supports reporting and compliance. Splunk Enterprise Security is a SIEM built on the Splunk platform.
XDR
Extended detection and response (XDR) correlates data from several security tools, and offers response actions. It starts with the tools you already have, and joins them. Cisco XDR draws on sources such as endpoint, email, network, identity and cloud products, and on Talos intelligence.
It presents an incident that groups related detections and shows the attack chain and the affected assets. From the incident the analyst can respond, for example isolate an endpoint or block a domain.
SOAR
Security orchestration, automation and response (SOAR) connects tools and automates the steps of a response. A playbook is a defined workflow, such as: receive a phishing report, check the link's reputation, search for other recipients, remove the message and open a ticket.
SOAR saves time on routine work, makes the response consistent, and leaves people to the hard decisions. Cisco XDR includes automation workflows, and Splunk SOAR is a dedicated platform.
Comparing the three
| Platform | Main strength |
|---|---|
| SIEM | Broad log collection, search, correlation and compliance reporting |
| XDR | Deep correlation across security tools, with built in response |
| SOAR | Orchestration and automation of response steps |
They overlap, and many organisations use all three. A common pattern is that the SIEM and XDR detect, and SOAR responds.
Managing and automating with Splunk
Splunk collects the data, and you use searches written in SPL (Search Processing Language) to analyse it. A search can become an alert that runs on a schedule, and the alert can trigger an action.
index=firewall action=blocked
| stats count by src_ip
| where count > 100This search counts blocked events per source address and keeps those above a threshold. Saved as an alert, it can send a notification, create a notable event in Splunk Enterprise Security, or start a Splunk SOAR playbook.
In Splunk Enterprise Security, correlation searches create notable events. Analysts review them in an incident review view, and risk based alerting adds risk scores to users and hosts so that several small signals can add up to one alert.
Splunk SOAR concepts
Splunk SOAR uses apps that connect to other products, assets that hold the connection details, and actions that the apps can perform, such as block an IP address or get a reputation. Playbooks chain actions together, with decisions and approvals. A playbook can be built in a visual editor, and it can use Python.
Automating safely
Start by automating enrichment, since it is low risk. Then add containment actions, with human approval at first. Log every automated action, and test playbooks before they run on live incidents.
What to remember for the exam
Seven facts cover most questions on this topic.
- SIEM collects and correlates logs, and gives search and compliance reporting.
- XDR correlates across security tools, and offers built in response actions.
- SOAR automates response with playbooks.
- Machine learning provides baselines, anomaly detection, correlation and risk scoring.
- Splunk searches use SPL, and a saved search can become an alert.
- Alerts can trigger notifications, notable events or SOAR playbooks.
- Automate enrichment first, and add containment with approvals.
If a question asks which platform automates a multi step response across tools, the answer is SOAR.
Common mistakes
These four mistakes appear often.
Treating XDR, SIEM and SOAR as the same thing. Each has a different main job, though they overlap.
Trusting machine learning blindly. It can produce false positives, so analysts must verify.
Automating containment with no approval. A mistake can block a critical system.
Collecting every log with no plan. Cost and noise rise, so choose sources by the detections you need.
Automated response actions can disrupt business systems. Begin with notification and enrichment, and add blocking in stages.
Check yourself
Work through these three questions.
What is the main job of SOAR?
To connect tools and automate response steps using playbooks.
How does a Splunk search become an automated response?
Save it as an alert, which can then create a notable event, send a notification or start a SOAR playbook.
In what two ways does machine learning help detection?
It builds behaviour baselines to flag anomalies, and correlates alerts into incidents or raises entity risk scores.
Topic 5 of 6 in Network Access, Visibility, and Enforcement
Test yourself on Network Access, Visibility, and Enforcement
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.