Rapid Evolution of Cisco SD-WAN is a Revolution for Enterprises with a Cloud-First Strategy

Just a few years ago, software-defined wide area networking (SD-WAN) was a “new” technology just breaking into the awareness of the IT market. It arrived at the time when enterprises were changing from moving applications and data to “a” cloud platform, to expanding to multiple clouds. SaaS application providers for CRM, HR, finance, and supply chain were firmly established as critical business resources that need to be accessible from anywhere via direct internet connections.

These were all positive changes, but not without a certain amount of pain. In particular, the traditional WANs were struggling with these new demands. The WAN architecture worked well when all connections from branches and a distributed workforce flowed back to a central data center through MPLS lines, where security policies were also applied. But the hub and spoke WAN architecture broke down as more direct internet connections were needed to access multi-cloud resources and SaaS applications. Continuing to backhaul all traffic to data centers before routing to internet cloud applications results in increasing MPLS costs, bandwidth inefficiencies, increased latency, and poor application quality of experience. In addition, WANs were often composed of components from multiple vendors, limiting the visibility and control over performance and troubleshooting.

SD-WAN was designed to answer these challenges. The technology provides methods to prioritize critical business traffic and take advantage of internet broadband connections—previously used for backup and redundancy—to connect directly to multicloud resources. SD-WAN simplifies the management of the wide area network fabric with a controller-first overlay that is independent of transport layers—MPLS, Ethernet, internet, leased lines, DSL, LTE networks, and soon 5G. SD-WAN controllers intelligently choose among the available transport mediums to deliver the best application performance as defined by IT service level agreements (SLA).

The Evolution of Cisco SD-WAN

In the early stages of SD-WAN, engineers at Viptela developed a flexible SD-WAN architecture based on cloud management and controllers (vManage and vSmart) and virtualized network function edge routers (vEdge). Their version of SD-WAN followed the same software-defined architecture as Cisco’s Digital Network Architecture (DNA), separating the Data, Control, and Management Planes for maximum flexibility. Viptela’s architecture made it a natural extension to Cisco’s Intent-Based Networking vision. Viptela’s visionary team and technology were acquired by Cisco two years ago this week—August 1st to be precise. Rapid innovations and integrations have been ongoing ever since.

Many of the innovations we’ve added come from listening to our enterprise customers who are seeking a solution to unite multi-domain cloud resources across a distributed organization. We hear that they need ways to simplify the interconnection of the domains with unified access and security policies applied across campus, branch, and cloud. Let’s look at the capabilities we’ve added to make Cisco SD-WAN powered by Viptela an enterprise-class platform that meets these needs and more.

Looking Deep Inside SD-WAN Operations

Networks are becoming much more complex as organizations tie data centers, remote branches, and a distributed workforce with multi-cloud applications using connectivity options like direct internet and LTE that are outside the direct control of IT. Therefore, it’s important to be able to see inside the WAN to monitor, measure, and adjust the parameters affecting performance. That’s why one of the first capabilities Cisco added to the SD-WAN stack was Cisco vAnalytics, a cloud-based tool for monitoring and analyzing SD-WAN performance via the vManage portal. vAnalytics provides specific information that enables IT to readily monitor bandwidth usage, application performance, and detect anomalies based on baseline application usage. Going forward, vAnalytics will incorporate more artificial intelligence and machine reasoning, as was recently introduced in Cisco AI Network Analytics.

Expanding SD-WAN to Cisco ISR/ASR Edge Routers

When considering a new technology, IT leaders prefer to avoid the need to “rip and replace”. Cisco alleviates that concern by making SD-WAN available to run on over a million ISR/ASR routers that are already serving branches and campus networks worldwide. Cisco IOS XE, released a year ago, provides an instant upgrade path for creating cloud-controlled SD-WAN fabrics to connect distributed offices, people, devices, and applications operating on the installed base of ISR/ASR routers. At the same time, we added the ability to run SD-WAN as virtualized network functions in a cloud provider’s IaaS platform, providing even more flexibility to quickly extend SD-WAN to the cloud.

SD-WAN Full Stack Security Protects Branch Data and Cloud Applications

When using the internet to connect branches and remote employees with cloud applications, sensitive data could pass over multiple networks outside of the control of IT, increasing security risks. Protecting the data while making it available on-demand to the workforce presents a series of technical and enforcement challenges.

To allay those concerns, Cisco, one of the top worldwide providers of network security solutions, integrated full-stack security into SD-WAN running on edge routers. Cisco SD-WAN Security is built-in, not composed of separate bolted-on components from a disparate variety of vendors, making security easy to manage via the vManage cloud portal. By integrating an application-aware firewall, intrusion detection and prevention, advanced malware protection, and Cisco Umbrella DNS cloud security layer, data security is easily and consistently maintained across branches.

In addition to securing branch and distributed workforce connections, IT wants to holistically address security concerns across multiple domains. That means setting access and security policies once and having them permeate the enterprise across data center, campus, and branch, to the cloud edge where IoT devices increasingly need to do local processing. Because Cisco designs security using an end-to-end perspective, creating cross-domain policies is not only possible, but a necessary capability as applications, data, and devices become more distributed and the workforce more mobile. Cisco is enabling unified policy management by linking ACI in the data center with SD-Access in the campus and SD-WAN for branches so that segmentation and security are applied consistently all the way from people and devices to the application hosting cloud platforms.

SD-WAN Cloud OnRamp for CoLocation Consolidates Regional Branch Connectivity

With SD-WAN making it simpler to configure and manage connections from branches to cloud resources, it’s just one more step to consolidate many regional branches under a common colocation facility. Creating an onramp connection from each of many branches to a colocation facility hosting a virtualized SD-WAN reduces the need for edge routers at each location and centralizes the management while providing all the same security and transport layer options.

In many cases, the target cloud providers and SaaS applications reside in the same colocation facility, thus shortening the paths and reducing latency to further improve application performance for potentially dozens to hundreds of branches. Additional virtualized SD-WAN instances in the colocations can also be quickly spun up to connect new branches as quickly as needed. SD-WAN Cloud OnRamp for CoLocation joins Cisco’s Cloud OnRamp for IaaS and SaaS to extend connectivity management from branches to multiple cloud platforms to provide granular control over application quality of experience via vManage.

Evolution of SD-WAN Continues for Revolutionary Results

All these innovations integrated into Cisco SD-WAN powered by Viptela are fundamental to building an Intent-Based Network. Built-in network intelligence translates business intents into network actions that provide consistent access policies, security for devices and data, and a high-quality application experience for a distributed workforce. Integrating multicloud compute resources with cross-domain access drives a revolution in business as enterprises strive to connect information to people anywhere at any time to improve employee productivity and customer experience.

National Instruments, an international leader in test and measurement systems, implemented SD-WAN to solve a number of IT and business problems. Like many organizations with a globally distributed workforce, the network supports communication services, software distribution, and access to applications and data resources among worldwide sites. The existing WAN greatly constrained video conferencing, slowed large software transfers, and couldn’t provide acceptable application performance. Implementing SD-WAN turned those issues around by:

◈ Reducing MPLS spending by 25% while increasing bandwidth by 3,075%.

◈ Categorizing traffic by function and type, sending backup traffic over the Internet under an SLA, eliminating bandwidth bottleneck on MPLS circuits.

◈ Reducing the time for software updates to replicate across the network from 8 hours to 10 minutes.

◈ Adding new internet-based services used to take months, with the agility of SD-WAN new services can be deployed in the cloud immediately.

◈ Eliminating the need for call admission controls and limiting video quality for conferencing

Enterprises are gaining advantages such as these by upgrading their aging WAN technology to SD-WAN. It’s not just cost savings by supplementing or replacing MPLS with direct internet connections that is motivating the transition to software-defined WAN architecture. It’s also about gaining flexibility and stability with intelligent, continuously monitored connections to multicloud resources and SaaS applications that are fueling the transition. In a software-defined world, people, devices, applications, and data are all securely connected to ensure organizations run efficiently as they tackle digital transformation projects. How will you use SD-WAN to support your digital revolution?

Continue reading

Thriving Ahead with the Advanced Cloud with CCNA Cloud

The evolution of the internet and internet-enabled services has changed everything around us. Cloud Computing is functioning as a catalyst to further fuel this development of the internet. Organizations are looking to hire Cloud Engineers who are experts in the advanced cloud technologies and informed about the Cloud best practices. Even a top technology company like Google is inviting Cloud Developers in unique ways.

In the light of this increased demand for Cloud experts, it is therefore vital for Software Engineers to consider a Cloud Certification to improve their possibilities of landing better career opportunities.
Cisco CCNA Cloud Certification is a globally accepted certification that can boost your career in this emerging area. This Cisco certification proves an applicant's skills on industry-leading cloud solutions, the best practices, and a job-role focused syllabus is followed in this Cisco CCNA Cloud certification.

CCNA Cloud Certification

This is a job role-based career certification. The CCNA Cloud certification syllabus qualifies cloud engineers, cloud administrators, and network engineers. This certification qualifies you to work in SMB cloud environment to support a senior cloud engineer. The job duties of CCNA Cloud Certified engineer comprises entry-level provisioning and support of Cisco Cloud solutions.

To become a CCNA Cloud, applicants need to pass two exams:

1) 210-451: Understanding Cisco Cloud Fundamentals (CLDFND)
2) 210-455: Introducing Cisco Cloud Administration (CLDADM)

Topics covered in CCNA Cloud Syllabus:

1. Cloud Deployments
2. Cloud Characteristics and Models
3. Providing End-User Support
4. Chargeback and Billing Reports
5. Cloud Provisioning
6. Basic Knowledge of Cloud Compute
7. Basic Knowledge of Cloud Networking
8. Cloud Infrastructure Administration and Reporting
9. Cloud Systems Management and Monitoring
10. Cloud Remediation

CCNA Cloud Certification is the most popular certification in the IT industry where every CCNA certified professional would choose the career as Network Administrator as an initial step.

What are the skills required for CCNA Cloud Certification?

• One should know the different network topologies to retain a secure IT network.
• Knowledge of how a computer network works and interacts with network devices.
• Configure the inter-switch communications.
• Implement IP addressing for specific network requirements.
• Perform specific tasks to administrate the wireless local area network.
• Support Network Address Translation and others in branch office networks.

How Beneficial is CCNA Cloud Certification?

• Cisco Cloud fundamental is intended for storage, computing, and networking to identify the cloud components and understand the fundamental infrastructure. CCNA Certification is the best option for everyone looking for routing and switching their career.
• The high-level cloud certification in CCNA is a combination of both software and hardware networking service to seize huge customers. This high-level certification will include certificates like CCNA Data Center, CCNA Security, CCNA Service provider, CCNA Video, CCNA Wireless, etc. The certifications in CCNA are split into Associate level, Professional Level, and CCIT the expert level.
• If you are practically skilled that is needed for CCNA Cloud professional, then there are more job opportunities waiting for you as the market for CCNA is tremendous everywhere.

Tips to get CCNA Cloud Certification

• A person who is aspiring to achieve CCNA certification should have knowledge both in theory and practical aspects to pass the exam. One should have absolute expertise in troubleshooting and networking issues.
• One should study from the right study material like latest editions of Cisco's books. Perform all the practice questions and lab exercises.
• Give as many practice tests as possible before the actual CCNA Cloud exam dates are scheduled. Determine the topic you require to work more and improve.
• Once you finish the CCNA Cloud certification, you can market yourself as a networking expert for global recognition as doors will not open for anyone for a bright, successful career. You always need to work hard to achieve the desired position.

Cisco’s CCNA Cloud certification is a precious tool for catching up the pace of change. The CCNA certification points out to current and future employers that you are a representative of that change, innovative, specializing in modern, cost-saving technology.

Related Article:

• 5 Success Mantras for Cisco CCNA Cloud Certification Exam
• Why You Should Get a Cloud Certification?

Continue reading

The ISR Family Expands SD-WAN Security and LTE Support

By now you most likely already know the benefits of implementing a software-defined WAN (SD-WAN). It’s no wonder 95% of enterprises surveyed by IDC expect to use SD-WAN within 24 months.

Cost of WAN Operations over 5 years. IDC: Business Value of Software-Defined Networking Infographic

Did you know, however, that SD-WAN could help lower your WAN costs by 38% over 5 years? Recent IDC customer interviews of mid to large enterprises found that respondents reported 38% lower 5-year cost of operations, 45% reduced app latency, and 33% more efficient WAN management when deploying Cisco SD-WAN solutions2.

So, if you’re considering an upgrade to SD-WAN, you’ll be happy to know that Cisco is continuing to expand platform support for Cisco SD-WAN powered by Viptela with new ISR models. We’re excited to introduce the new ISR 1120 and ISR 1160 models to the ISR 1000 Series. Both models will support the full suite of Cisco SD-WAN features including a full stack of security capabilities.

Why do you need the latest ISR 1000 models?

◈ Better user experience – The ISR 1160 is the highest performing router of the ISR 1000 series yet, featuring increased throughput and a 25% faster processor. Faster performance plus application optimization with Cisco SD-WAN equals happier employees and guests.

◈ Any location, any transport – Last year we introduced pluggable LTE technology with the ISR 1101 and 1109 models, and now we’re happy to introduce the same technology with the new ISR 1120 and 1160 models. This allows you to plug-in a CAT4 or CAT6 module for advanced LTE connectivity and with the fast paced growth of LTE technology, you’ll be able to upgrade to future LTE band support, like 5G, with ease.

◈ Right security, right place – Now you can protect users and devices and deploy embedded or cloud security faster using SD-WAN Security. The new ISR models feature 8GB of memory so you can run the full-stack of security, including application firewall, IPS, URL-Filtering and AMP directly into your ISR and manage it remotely via Cisco vManage.

Don’t forget that Cisco provides support, fulfillment and hardware replacement across the globe. With all the best features of the ISR 1000 Series and cost savings of Cisco SD-WAN, now available with the new ISR 1120 and 1160 models, it’ll be hard to find a reason not to deploy a software-defined network.

Continue reading

With Cisco Threat Response, The Best Things in Threat Hunting are Free

For those of us in security operations, it could be easy to feel discouraged. After all, it’s an unfair fight. The bad actors seem to have unlimited time and budget. And we certainly don’t!

But here’s some good news: one of the most valuable tools available in threat hunting is free. Just like the golden oldie tune (or the Janet/Luther pop classic) says, the best things in life don’t always cost money. For customers with Cisco Next-Generation Firewalls, Intrusion Prevention (IPS), AMP for Endpoints, Cisco Umbrella, Email Security, and/or Threat Grid, Cisco Threat Response helps detect, investigate, and take corrective action against cyber threats—at no additional cost.

Making the Fight More Fair

We work with security professionals in organizations of all types and sizes. No matter their differences, they all say they’re bombarded. They wish they could “hit pause” on the flood of security events to allow for the time-consuming manual work they have to do after an attack. Not only that, they’re often in the difficult position of having to make decisions with inadequate information. They’re concerned about blocking too much and compromising productivity. Or not blocking enough to protect the business.

Cisco Threat Response provides an automated process to help. It’s a key pillar of Cisco’s integrated security architecture and designed to give you the contextual awareness you need so you can see, investigate, and act on threats fast. If you’ve invested in Cisco security products that support it, Threat Response is on your side to make the fight against cyberattacks a little fairer.

Getting started with Cisco Threat Response is easy.

Fast for Anyone to Use

You don’t have to be an expert to use Cisco Threat Response. The interface is simple, intuitive, and interactive. Users can ask the tool to investigate a threat by simply cutting and pasting threat From the first click, Cisco Threat Response provides details on suspicious behaviors, files, and activities. Then click again, and it can be just as easy and quick to see, and in many cases remediate the root cause.

Easy-to-read, configurable graphics map the targets that have communicated with the malicious domain you’re investigating.

Not only that, information about the threat is collected and results are aggregated in the Cisco Threat Response portal. Here you get one common view, made even more powerful with knowledge from your other supported Cisco products. These products are fed by Talos, which delivers comprehensive threat intelligence with continuous updates to Cisco devices, automatically. In the Cisco Threat Response portal, it provides your network’s local sightings of the threat you’re investigating plus details to help you make timely and confident decisions about the best corrective actions.

Cisco Threat Response provides insights of integrated products to Investigate. The portal provides access to continuous threat intelligence geared to helping you respond quickly.

The browser plug-in makes it easy and convenient to pull indicators of compromise from any webpage or console and get verdicts directly from the drop-down. You can take corrective action or undertake a complete investigation (with collaboration and sharing) right from the page.

The More Cisco You Have, The More Value You Get

With the Firepower integration, Cisco Threat Response can now utilize intrusion alerts from the Firepower devices. This enrichment will amplify the contextual awareness in your network by harnessing the power of effective integrations with products such as AMP for Endpoints, Email Security, Threat Grid Umbrella and your Next-generation firewall. Another exciting thing about Cisco Threat Response is that when you have more Cisco solutions deployed, the integration drives more data enrichment and response capabilities. Contextual analysis becomes more detailed. We will continue to add new Cisco product integrations with Threat Response – the firewall products are only the most recent addition.

Continue reading

Running NetBeez Agents on Cisco Catalyst Switches

I am happy to announce a new powerful integration between NetBeez and Cisco. Starting with Cisco IOS-XE version 16.12.1, Cisco users can install the NetBeez docker agent on Cisco Catalyst 9000 series switches. This new integration is part of the Cisco application hosting framework, which enables third-party off-the-shelf applications to run on top of Cisco devices. As you’ll read in the next paragraphs, NetBeez and Cisco users will have a lot to gain from this integration. If you are new to NetBeez, let me tell you more about it.

Wide Area Network Monitoring with NetBeez

NetBeez is a distributed network monitoring solution that enables network engineering teams to monitor remote Wide Area Network locations via dedicated hardware or software agents, called Beez. The Beez run active monitoring tests, such as ping, traceroute, and iperf, as well as DNS and HTTP checks against web and cloud applications. Like a canary in a coal mine, the Beez proactively detect remote performance issues that impact end-users and business operations. The performance data logged by the Beez is sent real-time to the NetBeez central server, where it’s processed for alerting, displayed on the user dashboard, or consumed by third-party applications via the available APIs.

With the Cisco App Hosting integration, the Catalyst 9000 is capable of hosting NetBeez agents and run network performance tests from the user perspective. In this scenario, the NetBeez server is still needed to manage the Beez running on the switches and to collect the network performance data generated.

Benefits of Cisco App Hosting

Traditionally, the Beez runs on top of a Raspberry Pi that is plugged into the access switch at remote WAN sites. Companies that need to monitor large WANs have to invest considerable time and resources to ship and deploy the hardware appliances at remote locations. The Cisco App Hosting removes this “physical barrier” in the deployment and maintenance process of the Beez. Catalyst owners can now easily install via the Cisco CLI the NetBeez docker agent on their switches. Let’s see what this procedure looks like …

Configuring Catalyst for App Hosting

Configuring a Catalyst 9000 series switch to host a NetBeez docker agent is fairly simple. Before you begin, make sure you meet the following requirements:

◈ A Cisco Catalyst 9000 switch with IOS-XE version 16.12.1

◈ A USB SSD-120G for Catalyst 9000 series switches

◈ A NetBeez server running version 2.0

◈ The NetBeez docker agent v2.0.5

The procedure will have you:

1. Create a user VLAN that will be used by the NetBeez docker agent as uplink

2. Map the user VLAN to one of the switch’s access or trunk ports

3. Create an AppGigabitEthernet interface that is an internal bridge between the eth0 interface on the NetBeez agent and the user VLAN mentioned at step 1

4. Define configuration parameters needed by the NetBeez docker agent to connect to the server.

The following diagram illustrates how these different components relate to each other.

Continue reading

How AI is Changing the Game For Knowledge Workers

Have you ever wanted to ditch your mobile device, step back into the pre-internet everywhere era and pop on a Depeche Mode cassette? Yeah, me either. But for knowledge workers dealing with a constant stream of notifications and requests, stepping back a few decades might seem like a welcome reprieve. Luckily, artificial intelligence (AI) and machine learning are transforming the way we work and it’s not only leading to better outcomes, but more importantly, making our work life a little more pleasant.

“A Question of Time”

Today we can collaborate with anyone in any location but building relationships with our colleagues and focusing on higher value initiatives often takes a back seat to the day’s urgent request. In addition, the technology that’s meant to help us get our jobs done can themselves become barriers. Take a common virtual meeting, for example. Today, 85% of people experience online meeting problems and 42% felt frustrated in the last week because they could not easily join an online meeting. This software is meant to make our jobs easier and improve collaboration, but it’s not meeting our expectations. Even worse, these minor frustrations can add up to a lot of wasted time.

“The Landscape is Changing”

Enter AI and machine learning. While we’re a far way off from HAL 9000, there are market-proven AI capabilities that are being leveraged today to improve collaboration. This new form of collaboration, termed cognitive collaboration, is one where the machines are involved in the process — removing mundane tasks and facilitating a more human experience.

With capabilities like AI assistants and bots which help to facilitate and automate tasks and relationship intelligence that serves up information on meeting attendees, cognitive collaboration is transforming the virtual meeting experience.

“People are People”

According to a new survey by Dimensional Research, 72% of respondents said their meetings generally start late. When asked about why, some of the most popular responses were that they encountered:

◈ Problems joining the meeting (57%)

◈ Desktop or application sharing issues (43%)

◈ Background noise impairs the meeting (41%)

Imagine a world where everyone was prompted by a virtual assistant to join their meeting and all they had to respond was “Ok Webex, join my meeting.” No fumbling for a join code, no dial-in.

Or how about using your voice to share your screen and if you start typing away to respond to an urgent message, it’s automatically detected and your audio line is suppressed? These capabilities aren’t a future state — they are here today and are a core part of Webex Devices and Meetings.

While Webex Assistant will help your meetings run more efficiently, once you’re in the meeting, AI-generated people and company profiles will take your collaboration experience to the next level.

People Insights provides detailed profiles right in Webex Meetings, allowing us to discover shared interests and backgrounds and helping us get to know the people we meet with a little better. Not sure who someone is in the meeting? Check out their profile. Curious to see who the new person in your organization reports to? Reporting structure is a click away.

Today, over 80% of people spend up to 5 hours a week researching the people they’re meeting with — when the information you’re looking for is presented to you when you need, that’s a lot of time you can get back in your day. I’m not the only one excited about this. In a recent survey, 4 out of 5 respondents say having background information on people in the meeting would increase the meeting effectiveness. Beyond the meeting, it is helping to foster better relationships which can lead to improved team synergies and better outcomes.

“Enjoy the Silence”

These cognitive collaboration capabilities are game changers for knowledge workers, but it’s just the tip of the iceberg. As these capabilities continue to become interwoven into the collaboration platform and new AI-enabled features emerge, the in-meeting experience will rival, and maybe soon surpass, in-person collaboration. And at the end of the day, maybe that means you get a chance to enjoy the silence for a bit (cue the cassette).

Continue reading

Cisco Threat Response Plugin: Defeat Threats With Just a Few Clicks

One of the best tools in your SOC’s arsenal is something you might already have access to and didn’t even have to pay for. If you already deploy Cisco Umbrella, AMP for Endpoints, Firepower devices, next-generation intrusion prevention system (NGIPS), Email Security, or Threat Grid, then you can immediately access Cisco Threat Response for FREE. As in no charge. Zero extra dollars. No strings attached.

With Cisco Threat Response, customers receive a powerful solution that can streamline and simplify detection, investigation, and remediation of threats. In addition, Threat Response offers a very easy, powerful tool in the new browser plugin (for Chrome and Firefox). By adding the plugin, security professionals now have instant access to threat intelligence and response capabilities directly from their browser. To prove the simplicity of this, let’s use a straightforward example.

For the threat, we will use the Karkoff malware, used in the DNSpionage campaign.

Ah, it seems that Talos has a full spotlight of Karkoff. Towards the bottom of the blog, Talos gives a full report on Indicators of Compromise for Karkoff.

Traditionally, you’d have to manually copy and paste  each file, IP address, etc. from the blog, editing them to remove the defanging “safety brackets”, searching for each one in turn, in each of your telemetry sources – a laborious, manual activity. Cisco Threat Response simplifies this entire process by bringing all of these capabilities to one central source. So, let’s open the Cisco Threat Response browser plugin.

Immediately, Cisco Threat Response identifies 16 observables from this threat intelligence blog. 1 clean. 9 malicious. 6 unknown.

By clicking the malicious and unknown observables, we can tailor our investigation. We will not worry at all about snort.org, because we know Snorty is never up to anything bad!

As an example of how quickly we can take response actions, even before pivoting into Threat Response to do a more complete investigation, let’s look at kuternull.com. It is listed as “unknown.” By clicking the dropdown menu next to it, and pivoting out to other trusted intelligence sources like the Talos database or Threat Grid, we could quickly gather more information to determine a course of action.

For the purposes of simply showing the ease of the plugin, let’s assume we investigated this domain and there is no legitimate business need for our organization to be contacting it. In order to prevent potential malware activity, we will proactively block it now as a first level stopgap while we continue our investigation. Threat Response directly integrates with Umbrella, so we can immediately block the domain across our entire network with one click within the plugin.

Within a few seconds, Threat Response will flash a green banner confirming the blocking of the domain with Umbrella.

Now, after blocking a few domains quickly, our network is certainly better protected from Karkoff, but there is more investigation to be done. A quick click of the “Investigate” button will launch Cisco Threat Response’s cloud-based dashboard.

Cisco Threat Response will automatically load the list of the observables and provide insights with relation graphs, file hashes, and others.

Previously, Security Operations Centers (SOCs) would hear about trending threats and wonder, “Is my network affected by this threat?” To answer that question, it would require a series of manual processes that required investigating observables hundreds of times across the network, and then, writing sufficient policy to defend against these threats. To make life even more difficult, these solutions were often from different vendors and require manual processes to implement across different parts of the next work.

With Cisco Threat Response, within minutes, your SOC can:

1. Identify a trending threat from your SIEM, Talos, other threat intel sources, or virtually any third party product that has a web based interface

2. Identify a list of observables with one click

3. Quickly block domains across the network

4. Launch Cisco Threat Response for further investigation

It is important to note that Cisco Threat Response is a FREE add-on to existing Cisco Security solutions. In the example above, the user has Threat Response integrated with their AMP For Endpoints, Cisco Threat Grid, and Umbrella solutions. In addition, every user of Threat Response automatically gets access to the Talos Intelligence and AMP File Reputation databases for use in Threat Response. While Cisco Threat Response provides significant value when integrated with only one product, it becomes even more useful with each additional Cisco Security solution integration. It offers unparalleled central-management for detection, investigation, and remediation – and the browser plugins bring all those capabilities into any type of web content. Whether it is a blog entry like in this example, any other intelligence source, or the browser-based management console of any Cisco or third-party security or networking product.

Continue reading