Question Which third-party integrations does Cisco Threat Response (CTR) support? Answer Cisco Threat Response provides integration with many security products offered by Cisco, including Talos, AMP, Threat Grid, Umbrella, Email Security, Next Generation Firewall (NGFW), and Firepower. The product is adding more integrations every month, with Web Security, Stealthwatch, and Duo coming soon.   CTR natively supports Virus Total within the product. Third party integration via the public cloud APIs is available. You'll also find impressive integration underway with products like Signal Sciences. ... View more

Question I'm having a problem with Cisco Threat Response (CTR). How can I get support? Answer You can get help from Cisco Support. Since CTR is licensed with other Cisco products, you need the contract number for one of your Cisco security products to start a case. If you have trouble finding your contact number, you can engage Cisco Support (also known as Technical Assistance Center - TAC), via 1:1 chat or placing a phone call, listed on the support page. You can find all the information you need here.   When creating your case, simply add your contract number from your related product (NGFW, SMA, etc.). When selecting a product, search for "Cisco Threat Response" in the technology list. ... View more

Question I am logged into my NGFW/Firepower device and I see the message:   CTR will not be available until after Firepower 6.4 releases. Until then, configuring CTR integration in the web interface has no effect.   When will CTR be ready for me to integrate with my Firepower device?   Answer CTR integration with Firepower (versions 6.3 and newer) is currently in limited availability in North America. NGFW devices can now forward events to Security Services Exchange (SSE), which is where CTR collects events for incidents and enrichment. We are putting the finishing touches on the integration with Cisco Threat Response and it will soon be ready for public access. Following the North America launch, we will enable it in EU (with integration to SSE EU), followed by APJ. ... View more

Question I'm using Threat Response and would like to add more users to my organization so we can share casebooks, modules, and snapshots. How do I do that? Answer If you have an AMP EP cloud or Threat Grid cloud account, add users to your organization via that console. Otherwise, you can add additional users via the CTR account portal. What is an Organization? Users in the same company should be in the same product organization, so they can share configured modules, casebooks, and snapshots. Organizations are native to each product (AMP, Threat Grid, Umbrella, Cisco Security, etc.). ... View more

Question I would like to use Threat Response and keep my traffic local to the European Union. How do I do that? Answer You can access our EU region. Note that the account you use is local and distinct to the EU. Your AMP EP, Threat Grid, or Cisco Security account is created and distinct for the EU, and will not match accounts you may have created in other regions. ... View more

Question I've heard that Cisco Threat Response is free and allows me to hunt through my security alert data and block threats. How can I get an account? Answer Threat Response is free (included with a valid Cisco Security product). To get access, you can simply go to the login page and create an account.   Before you create a new account, here are a few things to remember: If you already have an AMP for Endpoints account, choose "Login with Cisco Security" and use that account. You don't need a new account. If you have a Threat Grid account, choose "Login with Threat Grid". You don't need a new account. If someone in your organization has access to Cisco Threat Response, AMP for Endpoints, or Threat Grid, don't create a new account. Instead, ask them to invite you to their organization, so that you can share modules, devices, casebooks, and snapshots. They can go to the respective user consoles for each product to send you an invitation. When you create a new account, the first thing you'll do is configure a related security product to activate your account. ... View more

Question Why am I receiving timeout messages when I conduct queries in Cisco Threat Response (CTR)? I see, "2 of 3 enrichments complete with 1 Alert"   When I open the alert, it says, "There was a timeout in the 'AMP for Endpoints' module. Retrieved 55 computers, processed AMP events from 10 of 55 computers." Answer This may happen occasionally on large AMP deployments. Here's what's happening: CTR implements a 60 second limit for all enrichments, and will wait for that period of time to retrieve results from any enrichment, including AMP, Umbrella, etc. We are exploring a model for long-running enrichments returning progressive results. CTR will also truncate results to a maximum number of sightings per observable per module. As our integrating products APIs become more performant and tuned to CTR use cases, we will continue to expand the scope of what CTR is capable of ingesting, aggregating, and displaying to the user. Workaround For exhaustive information during an investigation, go to the original sources. In this case, since you know which observable had the hits, and timed out, you can easily pivot on that observable into AMP. ... View more

This guide walks you through the Umbrella APIs and how to use them with Cisco Threat Response. ... View more

I have just received an email that looks like the attached (redacted) email telling me that I need to activate my Cisco Security account. What do I do with this?   Answer 1. This is an entitlement for a Cisco Security account. It is used to access the following applications: AMP for Endpoints Cloud (paid subscription needed) Threat Grid (paid subscription needed) Threat Response (free) 2. There is no charge to create and setup the account - it is free. 3. Clicking the link will allow you to create a new account, or login with your existing account and "claim" this entitlement. 4. If you have an AMP for Endpoints Cloud account already, it will work here, you don't need to create a new account (AMP for Endpoints accounts are subsets of Cisco Security accounts). 5. The account is created in our North America cloud. ... View more

Here is a getting started guide for Cisco Threat Response and Umbrella:   https://cs.co/ctr_umbrella ... View more