Integrate data and telemetry from your security stack for better detections and enhanced ROI.
This list of integrations is updated regularly and subject to change without notice. For the most up-to-date information on Cisco XDR integrations and their capabilities, visit the Cisco XDR online product documentation.
Unify data from applications, users, and devices to simplify asset assessment and response. Gather information from various sources (Cisco and others) for a holistic view for enhanced security.
*Requires Cisco XDR Advantage or Premier license.
Seamlessly ingest raw data from public clouds to gain comprehensive security insights across hybrid architectures. Utilize behavioral analysis to detect anomalies and establish baselines, empowering incident detections.
*Requires Cisco XDR Advantage or Premier license.
Enrich security posture insights by integrating with cloud security providers, making use of some detection data in incident creation, enrichment, and response.
*Requires Cisco XDR Advantage or Premier license.
Streamline teamwork through automated collaboration integrations to enable real-time updates, status changes, and direct interaction within Cisco XDR, fostering seamless communication and efficient incident response.
*Requires Cisco XDR Advantage or Premier license.
These integrations provide visibility into the top vector for initial access. This data can be used for investigations, attack chaining, enrichment, and response to stop malicious emails from spreading.
*Requires Cisco XDR Advantage or Premier license.
Employ EDRs for incident creation, attack chain mapping, contextual device insights, and incident enrichment. It even utilizes EDR response for faster containment.
*Requires Cisco XDR Advantage or Premier license.
Endpoint telemetry empowers XDR for unique process-level traffic identification, and contributes into anomaly detection, incident creation, and attack chaining.
Automated Ransomware Recovery with Cisco XDR simplifies response by triggering existing backup solutions to restore devices to their preattack state, eliminating data loss and the need for ransom payments.
*Requires Cisco XDR Advantage or Premier license.
Integrate a next-generation firewall (NGFW) for threat detections and incident creation through attack chaining. Query firewalls for enriched incident data and/or automate responses, simplifying security and boosting efficiency.
*Requires Cisco XDR Advantage or Premier license.
Cisco XDR expands device management to operational technology (OT) with IoT managers, enabling incident creation and enrichment from IoT threats.
Integrate IT service management solutions to automate tasks, prioritize incidents, and track response workflows to streamlining incident management.
*Requires Cisco XDR Advantage or Premier license.
NDR contributes to attack correlation based on network behavioral analytics and network context. It simplifies visibility, expands threat enrichment with network data, and streamlines incident management.
*Requires Cisco XDR Advantage or Premier license.
Use telemetry from SIEMs for enriched threat investigations. Translate data from diverse types (IPs, domains, files) into actionable insights, streamlining analysis and decision making.
*Requires Cisco XDR Advantage or Premier license.
Ingest threat intelligence from various sources, including Talos database and a user-defined repository. Integrate malware analytics solutions for detailed insights through automated global malware detonation and analysis.