About YZ2

YZ2 · 08-12-2025

Hi, I can't find a proper way to exclude a vulnerability scanner IP from alerts in SCA. One possible way to solve this (I guess) is to add entity groups for source IP and destination subnets. Afterwards select these entity groups in an Internal Conn...

YZ2 · 07-14-2025

Hello, When integrating cisco Secure Cloud Analytics into Cisco XDR, I came across the following obstacles. 1. in the overview of XDR integrations of other services, SCA is always followed by +Enable. Even after performing the integration, this view ...

YZ2 · 12-04-2024

Hi, I am looking for an option to remove the default and manually set values so that the values of my rules are applied. Or is there a bug that prevents rules from overwriting previously set values? Thanks in advance!

YZ2 · 10-17-2025

Playback always stops at "Overview. Architecture & Detection Layers" ~ 7:45min

YZ2 · 08-14-2025

Perhaps I am misinterpreting the rules. As I understand the rule, I have to enter the targets here. That is correct, isn't it? If I now enter 0.0.0.0/0 or only the private addresses, I will no longer detect scans from potential attackers because I ha...

YZ2 · 08-13-2025

Thank you for your reply. As I understand IP Scanner rules, I have to enter each destination address to this rule. This is pretty unhandy as there are several targets and possible changes in of IPs. Is it therefore possible to allow the source addre...

YZ2 · 05-21-2025

We are facing the same challenge of identifying whether this is a false positive or whether it really is something that needs to be looked at more closely. C:\Users\****\AppData\Roaming\Zoom\6.4.6.64360\Zoom.msi is moved to quarantine. detected ...

Member Since	‎04-12-2024 11:56 PM
Date Last Visited	‎11-26-2025 03:42 AM
Posts	7
Total Helpful Votes Received	1

User Statistics

User Activity

Exclude / Whitelist source IP in SCA from Alerts

Integrate Secure Cloud Analytics into XDR

XDR Asset Value - Override default/manual Value via rules

Re: Configuration & Deployment Best Practices

Re: Exclude / Whitelist source IP in SCA from Alerts

Re: Exclude / Whitelist source IP in SCA from Alerts

Re: False positive?