View this webinar recording for an advanced session inspired by "The Art of Defense," where we’ll show you how to seamlessly incorporate Cisco XDR and XDR Forensics into your daily security workflows. Discover how to turn raw alerts into actionable strategies and empower your team to respond faster and smarter.
The webinar covered the following topics:
- Review and correlate telemetry across multiple domains for deeper threat visibility
- Quickly triage and reconstruct attack sequences using forensic artifacts
- Orchestrate guided responses with MITRE ATT&CK-aligned detections
Webinar Q&A Highlights: XDR and Secure Endpoint Scanning
Product Capabilities & Differentiation:
How does XDR Forensics differ from Cisco Orbital and Secure Endpoint Forensics Snapshot? XDR Forensics provides advanced forensic capabilities, maintaining chain of custody and a persistent evidence repository with support for 350+ artifact types and an interactive shell for targeted response. Cisco Orbital is focused on live queries and scripting. Secure Endpoint Forensics Snapshot uses Orbital for detection-based data capture, while XDR Forensics offers a broader, more comprehensive forensic snapshot.
Is XDR a SIEM? No. Cisco XDR is a SOC efficiency and forensic validation tool that complements, but does not replace, traditional SIEM platforms.
Privacy, Compliance & RBAC:
How does XDR Forensics support privacy, GDPR, and RBAC? XDR Forensics leverages role-based access control (RBAC) and audit logs for compliance. Admins can purge data to meet privacy needs, including GDPR’s right to be forgotten. Shell access can be disabled via RBAC, and roles like Administrator, Incident Responder, and Analyst are supported, with further RBAC enhancements planned. Learn more.
Deployment, Licensing & Access:
How is XDR Forensics licensed and deployed? XDR Forensics is a module within Cisco Secure Client, available for XDR Advantage and Premier tiers. Deployment is managed via Cisco XDR Deployments, using either a full or network-based installer. The console can be accessed before deployment, but deployment is required for full functionality.
Data Access & Technical Details:
What technical access does XDR Forensics have? The module runs as a system service with admin credentials, enabling disk and memory access and 600+ artifact parsers.
Can findings be exported? Yes, forensic artifacts can be exported as CSV for analysis or integration.
Are product timestamps in UTC/Zulu time? Time zone settings are user-configurable.
Scanning and Endpoint Operations:
Can you initiate scans (full or flash) within XDR? Not currently. Secure Endpoint does not yet provide a scan API for XDR. As a workaround, Orbital scripts can trigger scans using sfc.exe. This may change as the product evolves.
Can XDR Forensics operate on isolated endpoints? Yes, XDR Forensics can still function after Secure Endpoint auto-isolation.
Usage, Permissions & Training:
Who can perform forensic snapshots and manage permissions? Incident Responders can take forensic snapshots. Permissions are managed at the role level and can be customized by Org Admins.
What training is available? Cisco offers click-through demos and is planning further task-based training. For advanced digital forensics, consider third-party providers like SANS. See the demo.
Integration & API:
Can incidents be documented with helpdesk/user context or device-specific details? While not built-in, XDR APIs allow integration with helpdesk and third-party tools for custom incident documentation.
Is MXDR linked with XDR? Yes, Cisco MXDR leverages XDR for managed security services.
Feature Requests & Roadmap:
When will new features like Instant Attack Verification and Attack Storyboard be available? Beta is planned for late 2025; general availability is expected in early 2026.
Is there a built-in sandbox? No, but Secure Malware Analytics with Glovebox can be used for sandboxing.
Product Operation & Scenarios:
Are assets added automatically to XDR Forensics? Yes, assets are listed automatically once the module communicates with the cloud.
Risk Scoring:
What risk scoring framework does Cisco recommend? Cisco recommends using the NIST SP 800-30 Rev 1 framework.
Have questions or want to learn more?
Realize better security outcomes with Cisco XDR by integrating Cisco and third-party tools to correlate telemetry across vectors for faster, more decisive incident detection and response.
View this XDR Forensics demo.
Learn about the Cisco AI Assistant for XDR.
