Thursday, 25 June 2020

Tips on How to Host a Great Virtual Event

Hosting a Virtual Event with Webex Events


Let’s face it… hosting a virtual event can sound pretty daunting. But don’t stress, we are here to help! Let’s pretend the big day is right around the corner and so far, you’ve scheduled your virtual event/webinar with Webex Events and the attendees are registered.

Now you may be trying to figure out “how can I keep everyone engaged?” or “how will I be able to reach my full audience?” or simply “OMG – How do I NOT screw this up?”

Well, sit back, relax, and let us help you navigate your way through hosting a great virtual event.

Days Before the Event


Recruit an event team– It may be helpful to have team members at your side during the event. Look into having a moderator to help with introductions, to transition between talking points, to interact with audience members through chat, and to deliver closing statements.  Also, identify a Q&A response person(s) who will manage the polling and Q&A panel. This will help you focus on delivering the best quality content. The “event team” (Q&A responders, moderators, etc) should be invited to the event as panelists instead of attendees.

Set up a time to rehearse- Schedule a 30-minute “practice event” through Webex Events with those that are helping you with the event (panelists). Make sure everyone understands the event format, which controls to use, and what their role is.

Check internet connection- Run the “health checker” report during your rehearsal to make sure you are fully connected. For optimal internet connectivity, we suggest hardwiring your internet connection.

Cisco Exam Prep, Cisco Tutorial and Material, Cisco Learning, Cisco Prep

Day of the Event


Minimize background noise – Ensure you are in a quieter location with minimal distractions. Less background noise will give your audience a better chance of hearing you clearly.

Check-in with the preview window- Chose your audio and video delivery platform whether that is your computer, video device, phone, or headset. We suggest using a headset/mic for optimal audio. The preview window also gives you a chance to check your background. Your kids’ playroom doesn’t make the best virtual event background? We get it. Customize your background by choosing one of the virtual backgrounds or apply a simple blur effect.

Be camera-ready- If you look good, then you will feel good. If that means jeans and a tee-shirt, great. If that means a blazer and a tie, then that is cool too. However, solid colors do work better for the camera. Being camera ready will help set the tone for the entire event.

Showtime – During the Event


Turn on video – Now that you are dressed for the part, make sure your video is actually turned on. Face to face interaction goes a long way. Turning on video creates a more intimate, realistic environment.

Join early and Turn on the practice session – Host, panelists and other event team members can join a practice session, while the audience is joining, without being seen or heard by the attendees. This session allows the host and panelists to communicate with each other without the attendees being able to listen in. It allows the host and panelists to connect, get on the same page, and make sure things are working properly before going live. When you’re ready to go live, end the practice session. Now it’s showtime!  (You can now be seen and heard by the attendees.)

Cisco Exam Prep, Cisco Tutorial and Material, Cisco Learning, Cisco Prep

Join your audience early- Once you are finished with the practice session, close the practice session to join in with the attendees. Join your attendees 15-25 minutes early to allow the audience to get settled and figure out audio/video before the session begins.

Identify the schedule- Create a clear event agenda and stick to it. Be clear as to what the purpose of the event is and what information will be covered.

And if need be, don’t forget to record!

Extend Your Reach


Live stream capabilities – Reach as many people as possible by live streaming your event through platforms such as Facebook Live or LinkedIn. (link to live streaming article) Live streaming your event will enable you to reach a wider audience.

Engage Your Audience


Emphasize the Q&A panel – Highlight the Q&A panel to encourage your audience to ask questions that may come up along the way. Designate a team member to help answer questions.

Cisco Exam Prep, Cisco Tutorial and Material, Cisco Learning, Cisco Prep

Videos/Content Sharing – Show a video or share content that you have created for the event. Break up the pace to keep your audience on their toes.

Ask for interactions (hand raise) – Work in commentary that allows your audience to identify with a statement using the hand raise feature. For example, ask your audience to raise their hand if it is their first time joining a virtual event or if they are tired of being stuck at home. The chat panel and polling feature also facilitate event interaction.

Wednesday, 24 June 2020

Meeting the Network Requirements of NVMe Storage with Cisco Nexus 9000 and ACI

Cisco Exam Prep, Cisco Tutorial and Material, Cisco Certification, Cisco Learning

One of the interesting things about working with Cisco’s high-end data center switches is seeing how well they adapt to new challenges.  We put a lot of engineering and R&D into products like the Nexus 9000, and for us it’s not just “faster and denser and more reliable.”  We like the challenges that network managers throw at us, and we like to help solve their problems.

Recently, a new type of storage transport “NVMe-over-fabric (NVMe-oF)” has been evolving, and we’re excited to see it shake up the world of storage area networking.  Until now, network managers haven’t had much of a challenge when it comes to storage: the network was so fast and the spinning hard drives so slow that natural network upgrades to 10G Ethernet (iSCSI) and faster Fibre Channel (FCP) speeds have kept storage managers happy.

What we’ve found in testing these new NVMe ultra-fast solid-state storage SANs in our labs is that things aren’t so simple anymore.  Storage teams now have the ability to saturate data center networks with incredibly fast devices. And this means that network managers need to look closely at this new generation of storage to understand what is different—and how they can meet the performance demands of truly high-speed storage.

NVMe storage offers multiple transport options namely NVMe-FC for Fibre channel fabric and NVMe-RoCEv2, NVMe-TCP for IP storage. Fibre channel networks can seamlessly handle NVMe-FC traffic and for IP storage we found some very interesting challenges for the network manager including:

◉ Flexibility – Integrate NVMe systems into existing networks using evolving protocols.

◉ Security – Securely deliver networking to NVMe storage systems, ensuring that clients and servers are isolated and that network connections between devices are tightly controlled.

◉ Performance – Deliver a high-performance network that meets the strict latency and loss requirements of these new storage protocols, even in the face of congestion and oversubscription.

◉ Visibility – Look deep across a whole network fabric to ensure that SLAs are being respected from end-to-end, all the way from client to server, and that capacity is available to handle failover events.

◉ Manageability – Accurately and easily deploy complex configurations, including access controls and traffic engineering across large switch fabrics.

We found that Cisco Cloudscale ASIC Powered Nexus 9000 switches and ACI Fabrics are great at meeting the challenges of NVMe-oF for IP based storage systems in data centers. We have done some testing and the findings are written in a white paper that does a deep dive into these five areas with testing results and configuration advice for network managers.

Here’s a summary of our results:

Cisco Exam Prep, Cisco Tutorial and Material, Cisco Certification, Cisco Learning

Cisco believes that different workloads will utilize different NVMe transport options and Cisco switches can provide the support for all three options (i.e. NVMe-FC, NVMe-RoCEv2, NVMe-TCP) today. We’re also working on a companion white paper showing how NX-OS powered Cisco MDS 9000 family products are taking the advantages of NVMe-FC innovations including, but not limited to, the NVMe analytics engine on the Cisco MDS 64GFC ASIC. Stay tuned for the NVMe-Anywhere whitepaper.

Tuesday, 23 June 2020

Enabling Cisco Enterprise Calling from Microsoft Teams and Slack Messaging

Strategic Alliances and Integrations Enable Comprehensive Calling, Meetings, and Messaging Capabilities


In my role as a product manager here at Cisco, I regularly talk to customers about their collaboration environments. One question I get asked is what they can do to bring together collaboration tools from different vendors…

The Webex unified app is providing our customers with comprehensive calling, meetings, and messaging capabilities that integrate with our award-winning video devices and IP phones. The result is seamless and consistent workflows.

But we are also aware that many customers have existing investments in place with collaboration tools from other vendors, and we are committed to making sure that Webex is an open platform, that integrates with 3rd party applications to ensure our mutual customers have a solution that delivers the best possible outcomes.

Earlier this year one of my colleagues talked about how we are enabling organizations with Microsoft Teams and Slack messaging users to start Webex Meetings from these applications.

Now, new Cisco calling integrations allow you to use all your enterprise-grade voice and video calling features in combination with these messaging platforms.

Cisco Calling Integrations


Calling integrations allow you to expose Cisco calling buttons directly in other vendors messaging apps. We’ve built the Cisco calling integrations to provide you with flexible solutions plus we’ve made them very easy to deploy. We started with Microsoft Teams and Slack messaging apps. To deploy a Cisco calling integration you simply select the Cisco client you are using for calling and the calling platform you want to use.
Cisco Exam Prep, Cisco Learning, Cisco Guides, Cisco Certifications

Figure 1. Cisco Calling integrations for Webex and Jabber in the Microsoft Teams app store

When you have added the Cisco calling integration, you can launch a Webex Teams or Cisco Jabber call directly from your messaging app. When you click the call button, the integrations identify who you’re chatting with, resolves their calling address, and passes this information to your installed Cisco client which starts a Cisco voice or video call. The integrations support all Cisco calling platforms including Cisco Unified Communication Manager (UCM) based on-premises and hosted deployments, and Webex Calling for cloud.

There are no complex back end changes to make as these are client integrations. There are no call routing policies or dial plan changes to make, no additional licenses required, and no new hardware to manage. You can even use the calling integrations with desk phone control, which means your users don’t have to replace their handsets.

Cisco Calling from Slack


Slack has made its messaging platform very open to integrating calling providers like Cisco. Adding the Cisco calling integration to Slack means you use the native Slack call button to start a Cisco call directly from Slack.

Cisco Exam Prep, Cisco Learning, Cisco Guides, Cisco Certifications

Figure 2. Placing a call using Cisco Jabber from Slack

This could be using Webex Teams or Cisco Jabber as your softphone or controlling your desk phone. If your Cisco client is controlling your Cisco desk phone clicking the call button in Slack causes your Cisco desk phone to go off-hook and call your colleague.

Slack is popular with developers where users tend to like keyboard commands to take actions like making calls. Talking to Slack users it becomes clear this is a requirement for Slack users so we implement “/jabber” and “/webexteams” slash command allowing you to make calls at the command line.

We are continuing to work in partnership with Slack and plan to implement Slack’s new shortcut controls shortly. This will give you more calling destination selectable directly in Slack.

Cisco Calling from Microsoft Teams


The Cisco calling integration for Microsoft Teams has been available from the Microsoft Teams app store for just over a month now. This month we have extended it with new features and functionality. In addition to supporting Microsoft Teams desktop and web users, this month we added support for mobile and tablet devices. We also added new contact search capabilities, you can now search your Microsoft 365 Outlook contacts and call them using your Cisco calling platform via the integration.

Cisco Exam Prep, Cisco Learning, Cisco Guides, Cisco Certifications

Figure 3. Placing a call using Webex from within Microsoft Teams

Building Bridges with Webex


These two new calling integrations are just examples of the many integrations that the Webex platform supports, enabling people to enhance their communication and collaboration within their everyday workflows. For example, we’ve also worked with Microsoft to integrate Microsoft SharePoint and OneDrive Enterprise Content Management (ECM) solutions into Webex team messaging services to streamline collaboration on documents.

Monday, 22 June 2020

Cisco SD-WAN Soars Towards SASE with Simple, Secure and Scalable Innovations

Cisco SD-WAN, Cisco Tutorial and Material, Cisco Learning, Cisco Certification, Cisco Guides, Cisco Prep

The world is changing, and the workforce is changing with it. The move to distributed teams, telework and pop-up clinics has only accelerated the path to cloud adoption that customers have been on the past few years. IT professionals surveyed by ESG say that half of the workforce will be operating remotely in 2021. The survey also says that 60% of organizations expect that the majority of their applications will be delivered as SaaS then, too*. This makes the Internet itself the wide-area-network, displacing traditional WAN connectivity like MPLS. Enterprises want to be able to extend their reach from campus and branch offices into their employee’s home offices and micro-branches, as part of this distributed workforce trend.

The architectural concept for today’s SD-WAN is often called Secure Access Service Edge (SASE). It reflects the reality that WAN security and features today must be distributed, cloud-based, flexible, and agile. But there is a clear need for an integrated solution from a single vendor and Cisco has been working on this for the past several quarters. Today, we are proud to announce that with the latest 17.2 release of Cisco SD-WAN, we have the industry’s first fully integrated SASE offering that combines best-of-breed SD-WAN with the cutting-edge Cisco Umbrella Cloud Security portfolio.

Cisco SD-WAN 17.2 offers customers:

◉ Simple Management and One-touch Connectivity from SD-WAN to Umbrella Secure Internet Gateway (SIG),

◉ Deployment Flexibility for any design – Teleworker, Branch or Campus

◉ Automatic assessment of the Identity of the user and their context, to enforce policies,

◉ Simple and Flexible Consumption models that include Cloud Security capabilities at no additional cost,

◉ A complement of the Cisco SD-WAN on-premise security stack that includes the newly added SSL Proxy capability.

We have heard loud and clear from our customers that they simply do not have the time or the resources to stitch together disparate products and build their own SASE solutions. The analogy that customers have given us is that no one wants to buy different parts of a car and assemble it themselves anymore!

Cisco has a clear, differentiated strategy that will enable customers to get the best of SD-WAN and Cloud security as a single, integrated solution. I truly believe no other company is better positioned than Cisco to help customers on their SASE journey as we navigate this new environment.

Cisco SD-WAN, Cisco Tutorial and Material, Cisco Learning, Cisco Certification, Cisco Guides, Cisco Prep

Cisco SD-WAN 17.2 is the industry’s first fully integrated SASE solution.

However, this is just the tip of the iceberg when it comes to innovations in our new 17.2 SD-WAN release. We are enabling 60+ innovations in this release. Beyond the SASE innovations described above, here are a few more of the most noteworthy capabilities.

◉ Unified Communication Integration: With a growing demand from customers for reliable and secure unified communication from private and public clouds over broadband internet connections, Cisco SD-WAN now supports Unified Communications, with a voice gateway capability. This allows customers to create a communication network that ensures an optimized UC application experience, and it can be managed from a single dashboard.

◉ Cloud OnRamp for SaaS: We continue our Cloud OnRamp journey by adding OnRamp capabilities to the industry’s most-used SaaS products:  Office365 plus 14 other SaaS products on the IOS XE portfolio. This will enable customers to get a differentiated user experience for SaaS, using their existing ISR router installed base.

◉ Managed Service Provider Innovations: Cisco has the largest ecosystem of managed service providers, reflecting our understanding of the complexity of providing a managed SD-WAN offering to our joint customers. We continue to enable our MSPs to deliver flexible and customized WAN services through capabilities like CLI templates that unlock the power of 30+ years of IOS innovations to the SD-WAN. This complements our new post-paid licensing packages.

We have already seen over 3000 downloads of our 17.2 software, which illustrates the demand for these capabilities from our customers. We look forward to even more customers and partners adopting these new SD-WAN and SASE capabilities.

Sunday, 21 June 2020

Cisco is Identified as a Leader in Aragon’s Globe for Intelligent Contact Center 2020

Cisco Tutorial and Material, Cisco Exam Prep, Cisco Guides, Cisco Certification

Driving Business Growth for Customers with the Intelligent Contact Center


Over the past year, Cisco has been advancing our contact center portfolio to help our customers drive business growth and competitive differentiation.  We’ve launched Webex Contact Center in multiple geographies, and recently introduced Webex Contact Center Enterprise, a robust, scalable, cloud contact center solution that meets the unique and sophisticated needs of very large enterprises.

We acquired Voicea, and quickly integrated new AI-powered agent call transcription capabilities that improve productivity and call wrap-up efficiency through best in class word error rate and transcription accuracy performance. Our second major acquisition was CloudCherry, which resulted in Webex Experience Management, our first experience management SaaS solution that enables companies to do meaningful analyses of their customers’ feedback and journey experiences to improve business outcomes such as Net Promoter Score and customer lifetime value.

We made significant enhancements to our on-premises solutions providing our customers with a simpler way to manage their software licenses, and integration to advanced cloud services such as analytics reporting, call transcription, and customer feedback metrics at the agent desktop – all reducing pain of adoption for cloud services.

We announced the Webex Platform for Contact Center, an open and flexible multi-tenant cloud solution, based on the Webex architecture that is the underpinning of our contact center portfolio and forms the foundation for all future innovations.

Lastly, our AI portfolio grew substantially during the year, with the introduction of a conversational IVR solution, deep integration to Google Cloud Dialogflow, and plans to deliver more AI-based capabilities in the near future.

Identified by Aragon Research


We are thrilled that our portfolio and strategy have been acknowledged again this year by globally recognized industry analyst firm Aragon Research. In their 2020 Aragon Globe for Intelligent Contact Center, Cisco was identified as a leader in its Intelligent Contact Center category.

Aragon Research is an independent research and advisory firm, with decades of experience in helping business and IT executives make more informed technology and strategy decisions.  The Aragon Research Globe is a market evaluation tool that looks beyond size and market share, using those as comparative factors and evaluating a providers’ complete portfolio capabilities. Positioning in the Globe reflects how complete a provider’s future strategy relates to their performance in fulfilling that strategy in the market – a balance of both performance and vision.

Cisco Tutorial and Material, Cisco Exam Prep, Cisco Guides, Cisco Certification

Copyright © 2020 Aragon Research Inc. and/or its affiliates. All rights reserved. Aragon Research and the Aragon Research Globe are trademarks of Aragon Research Inc.

Aragon’s analysis evaluated key areas such as product strategy, performance and execution, and global reach. According to the report authored by Aragon Research lead analyst Jim Lundy: “Cisco, a leader in UCC, has made a series of announcements in 2019 that strengthened its overall focus on contact center, with AI at the center.”

Here are some of the key reasons that we believe contributed to our leadership position:

The Cisco Brand

Cisco’s brand is globally known for its innovation, extensive R&D, open platforms, digital transformation, and for shaping the future of work.  We’re known for our ability to execute in scale for large enterprise contact center deployments, and for our deep familiarity with the needs of enterprise IT and line of business leaders.

Contact Center Installed Base

Over 3 million agents across 36,000 different enterprises are using Cisco Contact Center solutions today, making us a market-share leader for contact centers – number one in North America and number two worldwide. Our customers range from small businesses to very large enterprises across all industries. We have a specialized contact center sales organization and an extensive partner network serving our customers globally.

Focus on AI

We’ve made significant investments in our AI practice through acquisitions such as Accompany, Voicea, MindMeld, and CloudCherry. From those organic capabilities, we have developed a robust set of AI solutions that are powered by our own in-house AI, and through our partnership with Google Cloud, we leverage their Cloud Contact Center AI (CCAI) platform which allows us to accelerate the adoption of advanced AI capabilities to the market.

Flexible Cloud, Premises, and Hybrid Deployment Options

Our multi-cloud approach and flexible consumption model makes it easy for customers to take their first steps to cloud transformation to effectively meet the pain of adoption and scalability issues while enhancing their on-premises investments. Our Webex Platform for Contact Center provides a practical path for every Cisco contact center customer to benefit from cloud agility and continuous delivery of innovative features, while they migrate without disruption over time.

End-to-End Encryption

Cisco has an industry-leading reputation for enterprise security. We continue to invest to make your contact centers more secure, and protect your customer’s privacy and confidentiality. Our products adhere to Cisco’s high-security standards and adherence to quality of service and performance, giving our customers a rock-solid contact center foundation and the peace of mind they expect from a security leader like Cisco.

Overall Unified Communications and Collaboration Capabilities

Cisco stands apart from other contact center providers by focusing on the “big picture” delivering a broad and integrated portfolio in all areas of communications ranging from contact center, messaging, meetings, calling, security, networking, and devices. This allows us to offer tremendous productivity benefits and economies of scale through the integration of key capabilities. These capabilities support a concept we call the Collaborative Contact Center, where front and back-office resources work hand in hand on real-time customer issues. Another example of this is how we are integrating Webex Calling with Webex Contact Center to improve call quality, reduce costs, and ease of solution acquisition.

Saturday, 20 June 2020

Workspaces in Control Hub— What’s in it for you?

Cisco Prep, Cisco Guides, Cisco Learning, Cisco Certification, Cisco Tutorial and Material

Optimize your Workspace Through Control Hub


As announced at Cisco Live, we have introduced a new range of intelligent features in Control Hub under the new Workspaces tab. This will revolutionize the way IT, facilities, and HR work together, making the transition back to the office as seamless and safe as possible.

Control Hub is the single pane of glass management platform that provides administrators a view into their Devices, Meetings, Calling and Messaging environments, all without transitioning to different tools. Administrators have the ability to deep dive into analytical trends or troubleshoot reported issues directly in the platform. On the devices side, Control Hub has mostly focused on technical issues, such as packet loss and jitter. Now, we are expanding that to include what is happening in the physical workspace! By giving visibility into what is happening in the workspace, you will gain deeper insights into emerging and existing trends within the four walls of your workspace. Knowledge is power, and with these new insights, you can make better strategic decisions.

How to Navigate the Workspaces Tab


The first part of this new Workspaces section is the ability to set a “Workspace Type.” You can choose between a plethora of room types, such as “Meeting Room”, “Huddle”, or even “Desk.” This allows for effortless filtering and reporting on different workspace types to easily find trends. For example, if a certain style of workspace is not being adopted, or it is all the rave being spoken about around the coffee machine!

The other new attribute you can add to a workspace is capacity. Now administrators can easily find out their capacity in certain locations or find out if their workspaces are being utilized correctly. If the capacity is exceeded, you will be notified with visual indicators. This makes it easy to ensure you are staying in line with the recommended people counts in different rooms.

Cisco Prep, Cisco Guides, Cisco Learning, Cisco Certification, Cisco Tutorial and Material

Real-Time Utilization and Environmental Data

That leads me to the next new change in Workspaces, and that is the ability to see real time usage of utilization and occupancy directly in Control Hub – no need to refresh! This data is not just limited to showing whether the room is being occupied or by how many people, but it also has environmental data like ambient noise level and sound levels. This data is vital to ensure the workspace is the set up for collaborative success. A workspace with ambient noise above a certain dBA level will impact the quality of the meeting experience, both for in-office and remote participants. No one wants to work in a noisy environment. It is simply distracting!

Cisco Prep, Cisco Guides, Cisco Learning, Cisco Certification, Cisco Tutorial and Material

Let’s say you need to install some acoustic treatment based on the recommendations of our advanced troubleshooting tools to test the reverb of the meeting space. Then it is useful to know whether the workspace is booked for later, so that you can schedule the best time to intervene. We got you covered! You don’t even need to leave Control Hub to view the calendar in a different application – booking information for the next 24 hours is right at your fingertips. For privacy reasons the meeting title won’t be exposed, so no worries there.

Cisco Prep, Cisco Guides, Cisco Learning, Cisco Certification, Cisco Tutorial and Material

These are just some of the changes, all designed to give administrators a better experience and help manage their workspaces and devices more efficiently. With the ability to see data directly on one page, it really is like a virtual cockpit for your workspace!

This is just the start of a journey. We are investing in bringing more tools and metrics of the workspace to the fingertips of administrators, the next thing on our roadmap is bringing historical metrics and APIs to connect to existing workflows.

Friday, 19 June 2020

6 Essential Elements of Your Managed Detection and Response Lifecycle – Part 2

This is Part 2 of our series on developing a managed detection and response strategy. If you missed Part 1, catch up here.

In the first part of this blog, we discussed the growing trend of remote work, how organizations have adapted to new working styles, and how this shift has created new challenges for security operations. We introduced a security operations detection and response methodology created around use cases, examining the first two of six phases – identify and prioritize.

In Part 2, we’ll guide you through the remaining four lifecycle phases: develop, evaluate, deploy, and enhance.

Cisco Tutorial and Materials, Cisco Certification, Cisco Exam Prep, Cisco Study Materials

Develop


As we discovered previously, establishing and documenting a procedure for identifying and prioritizing threat scenarios allows you to maintain rigor and discipline throughout the security operations lifecycle.

Here’s an example of steps SecOps teams could follow when developing a use case:

◉ Step 1: Review and refine the description of the threat and the requirements for addressing it
◉ Step 2: Ensure monitoring tool deployment and configuration
◉ Step 3: Validate data sources
◉ Step 4: Validate context sources
◉ Step 5: Perform a gap analysis against security operations procedures

Evaluate


Once a use case is developed, you’ll need to determine what will trigger a review or reevaluation of its function.   This will help avoid the “set it and forget it” approach that often leads to security operations teams losing sight of the need for this critical part of the lifecycle.

The better approach is to define clear notification criteria, so SecOps teams can ensure each use case stays relevant. This way, when thresholds are met – or when there is a change or update to the available context data – use cases can be reevaluated.

For example, age/duration, changes in compliance, threats, and data security can require a reevaluation of threat definitions, monitoring tools, contexts, validation metrics, and performance – or they could make a use case redundant entirely. Having a clear set of metrics that trigger reviews ensures necessary evaluations are not overlooked.

Deploy


The deployment phase involves the following practical tasks:

◉ Training security operations teams to respond to new alerts with clear actions
◉ Updating and publishing runbooks, ops guides, and process documents
◉ Promoting code through testing, staging, and production environments
◉ Reporting threat validation metrics

Once deployed, use cases must be continuously incorporated into the evaluation and enhancement workflows.

Enhance


Unlike the evaluation phase, fine-tuning a use case is not driven by network or business changes. Rather, it is driven by the evolution of threat tactics, techniques, and procedures, as well as changes in data and context. The purpose of this phase is to provide clear actions and remove any uncertainty.

Like other phases in this lifecycle, a defined process will allow teams to successfully address the rapidly expanding threat landscape.

Elements that could justify a reevaluation include:

◉ Event generation settings, thresholds and metrics
◉ Outputs, such as impact and urgency
◉ Environments leveraging automation
◉ Additional response options

Similar to the previous phase, you need to address operational processes, update runbooks, and provide training to Security Operations Center analysts.

Overlooking these activities or handing them over to operations analysts is a recipe for losing ground in the fast-paced threat landscape. It can lead to analysts being unable to effectively manage the overwhelming number of alerts, and increase the risk of human error, which in turn prolong investigations and increase workloads.

Taking a disciplined approach to structuring responsibilities and expectations for your teams will ensure continuity, while supporting the continued growth and maturity of your security operations program.

Learn from the experts


If you don’t have the resources to keep pace with the evolving threat landscape and manage security operations comprehensively, consider a solution like Cisco’s Managed Detection and Response (MDR). Our team of security investigators and responders utilize the unmatched threat research of Talos, and proven playbooks to guard your organization’s IT around the clock.