Built on Cisco Security Cloud: XDR

As we enter the age of Cisco Security Cloud, we have delivered on the first phase of our vision that aims to provide organizations with a comprehensive, open, and integrated platform for protecting their users, data, infrastructure, and applications whether on-premises, in the cloud, or both.

In the era of hybrid clouds, security platforms must meet organizations where they are to protect their data, networks, and systems from cyberattacks. Hybrid clouds combine on-premises and cloud-based resources, which can create new and complex security challenges. For example, it can be difficult to manage security policies across multiple environments, and it can be difficult to detect and respond to threats that move between on-premises and cloud environments.

During the RSA Conference in 2023, we launched our first product on the Cisco Security Cloud and unveiled Cisco XDR to the world. Cisco XDR is a cloud-based extended detection and response solution for security operations teams that detects, prioritizes, and remediates threats more efficiently to achieve security resilience. Integrating with the broad Cisco security portfolio and many third-party offerings, Cisco XDR is the most comprehensive solution on the market today.

Cisco XDR leverages the Cisco Security Cloud to provide organizations with a comprehensive view of their security posture. XDR collects data from across the security stack, including endpoints, networks, cloud, firewall, and email, and uses machine learning and artificial intelligence to identify and respond to threats in real time.

Overall, Cisco Security Cloud’s capabilities benefit Cisco XDR in several ways. By providing common data, centralized provisioning of physical identity and access management (PIAM) policies, and native cross domain telemetry, Cisco Security Cloud helps to improve the effectiveness of Cisco XDR in detecting, investigating, and responding to threats.

Here are some of Cisco Security Cloud’s capabilities that benefit Cisco XDR:

• Common Data: This makes it easier for Cisco XDR to correlate data from different sources and to identify threats that might otherwise be missed.
• Native Cross Domain Telemetry: Cisco Security Cloud can collect and correlate data from across the entire security infrastructure, including on-premises, cloud, and hybrid environments. This gives security teams a more complete view of the security landscape and helps them to identify and respond to threats more quickly.

Additionally, Cisco Security Cloud facilitates the following Cisco XDR capabilities that benefit SOC processes:

• Threat Detection and Hunting: By leveraging advanced analytics and machine learning algorithms using behavior-based analysis and anomaly detection techniques, Cisco Security Cloud identifies potential security threats leveraged by Cisco XDR for early detection and proper prioritization of unknown/zero-day threats as well as known malware.
• Incident Investigation and Response: When a security incident occurs, Cisco Security Cloud provides real-time alerts and actionable insights to facilitate rapid investigation under Cisco XDR. It offers crucial information about the incident, including affected assets and related indicators of compromise where recommended remediation steps are displayed by Cisco XDR.

With Cisco Security Cloud, Cisco XDR can detect, investigate, and respond to threats more effectively. As a result, organizations are able to improve their security posture and ensure that their data is protected against cyberattacks.