Cisco XDR

We are system integrators working in a consultancy mode with a team of implementation engineers. Over the last two years, we have worked on several Cisco XDR  cases. In data centers, Cisco XDR  is definitely the primary requirement. Our first choice is always Cisco, and while one or two other solutions have come our way, Cisco cases primarily come to us. In a certain segment, Cisco XDR  is definitely the first priority. I would say that about 80% of my customer base relies on Cisco XDR . We are partners of Cisco and we focus particularly on the implementation aspect, while also taking care of services.

Cisco XDR is one of the most matured systems available. It is quite user-friendly. The system has been very effective, and our customers receive sufficient reports demonstrating visible benefits. This helps maintain customer confidence, particularly in secure data center implementations. With the implementation we have deployed, our customers gain confidence in having their data center secure. The reporting capabilities are pretty extensive. Cisco XDR is keeping our customers protected.

It would be difficult for me to identify specific improvements at this moment. We have not really foreseen exactly what additional benefits might be needed. Given more thought, something could potentially come out, but we have not found any requirements for additional features.

The solution is working well for our needs.

There were some challenges initially, but with the technical support provided, we were able to resolve them and move forward successfully.

Scalability has been a consideration for our implementations.

The technical support has been very helpful. During implementation, we receive assistance from the technical support team and have obtained proper support from their side.

In a certain segment, Cisco XDR is definitely the first priority. I would say that about 80% of my customer base relies on Cisco XDR as the way to go.

We are partners of Cisco and focus particularly on the implementation aspect. We also take care of the services.

Cisco XDR has helped our customers achieve positive returns on their investment.

I strongly feel that Cisco XDR is more proactive rather than reactive compared to alternate solutions.

It would be difficult for me to provide additional advice at this moment. I would give Cisco XDR a nine out of ten. I would definitely recommend it. I

Cisco XDR  serves as the main platform for threat detection and threat response in my organization.

We have integrated all of our internal devices including firewalls, servers, EDRs, and endpoints into Cisco XDR . In typical scenarios, we find blacklisted IP communication detected by our firewall, and Cisco XDR  blocks these particular attempts made by blacklisted IPs, thereby helping us secure our environment from potential cyber threats.

We focus on the alerts generated by Cisco XDR  and the threat intelligence reports available on the platform. Our security team reads through those reports and proactively blocks those IPs and the IOCs on our firewall rather than waiting for Cisco XDR to raise an alert about a particular IP or IOC attempting to communicate with the environment. The threat intelligence information available on the platform is quite useful for us to proactively take actions to better secure our environment and reduce our attack surface for potential cyber threats.

Cisco XDR offers a wide range of integrations and connectors where we can integrate a whole range of devices available in our on-premises environment as well as cloud sources which we have primarily on AWS  and Azure . Those environment log sources are integrated with Cisco XDR and it helps provide a single pane of glass view in terms of our security posture, giving us visibility within a single platform rather than focusing on individual security devices such as firewalls or EDRs which would typically be working in silos.

These integrations are straightforward. Cloud workloads are easier to integrate compared to on-premises devices, primarily because the cloud workloads have readymade connectors and integration standard operating procedures for us to integrate with Cisco XDR. We have typically not faced challenges with integrations with Cisco XDR. There may be certain OEMs which are not well known and cannot be directly integrated without the help of vendor support or OEM support, which we were able to connect with and ensure they are integrated with Cisco XDR.

From the reporting perspective, the dashboards offer quite a lot of predefined and useful options which help with live threat monitoring and provide a high-level view of the current threats, incident reporting metrics, mean time to detect, and mean time to respond. These sorts of dashboards are available on the platform and help provide a good view even for someone at the leadership level.

Cisco XDR has definitely improved our security posture and our visualization, ensuring that we are protected and providing greater visibility for our SOC team.

Cisco XDR has definitely reduced our mean time to respond. Previously it used to be more than 24 hours, but we have been able to reduce it to less than 16 hours due to all the various integrations and automation capabilities.

Cisco XDR has been useful for us to gain visibility into gaps in our security posture and how those can be improved by conducting analysis on the platform itself. We have utilized the platform to improve our security posture and reduce blind spots.

Cisco XDR can be improved in terms of out-of-the-box integrations and standard operating procedures available on the platform where we would not have to refer to documents outside of the platform to integrate. Having these standard operating procedures or integration methods available within the platform for most devices will help improve our experience with Cisco XDR.

The primary area for improvement is the integrations itself.

I have been working in my current field for about ten plus years.

Cisco XDR is stable in our environment and we have not found major issues in terms of downtime or lack of monitoring coverage.

In terms of scalability, Cisco XDR is quite scalable in terms of a licensing model and the number of assets we have integrated with it. It is seamless.

The customer support has been quite good. When we raise a ticket on technical support, they reach out to us within a couple of hours to listen to our issue and provide us with solutions. I would rate customer support at nine out of ten.

We used IBM QRadar  before we switched to Cisco XDR primarily because IBM QRadar  was more a legacy system and customizations, connector building, parser building, and integrations were taking a long time where we had to reach out to IBM for support. With Cisco XDR, we found a quicker turnaround time.

Our team required extra training and onboarding support during the initial phase, but as of now they are using it seamlessly. I would rate it at approximately eight out of ten.

We have experienced return on investment since we have been utilizing this platform for the last five years. Over time as the platform has evolved and more automations have been put in place, the number of human resources required has drastically reduced. Previously, we used to require four people in each shift to manage all of the incidents and workloads, which would essentially be about twelve people per day. We have been able to cut them down to six people per day, which is roughly half the team size required as of now. This helps in saving cost and time.

In terms of licensing and support cost, it is quite seamless. Based on the number of users we require, we have purchased as many licenses, and the setup is also a one-time cost which we received support for from Cisco's technical support team.

Before choosing Cisco XDR, we evaluated Splunk, IBM QRadar which was already existing in the environment, and Microsoft Sentinel . Cisco XDR was the best option in terms of overall feature capabilities and pricing.

In terms of DLP , Cisco XDR is quite useful. We are using a different DLP  as well within our organization, so we are not extensively relying upon Cisco XDR for DLP, but it is a good solution to fall back upon. In terms of pricing, it is not the cheapest but it is also not the most expensive compared to other products we have experienced in the past.

Cisco XDR is hosted on private cloud.

We are typically deployed on AWS  and have utilized automation workflows to improve our mean time to respond, reducing it from over 24 hours to less than 16 hours.

We prioritize incidents based on its criticality in terms of which devices or environments are affected that we have integrated with this platform. This has definitely helped in prioritizing incidents and ensuring that we have good coverage twenty-four hours a day, seven days a week across business hours and non-business hours by looking at the trend of what incident types occur and how often they occur, as well as what kind of team support is required across multiple shifts during the day and night.

The platform helps our SOC team access the platform across the entire shifts. We follow three shifts, and it helps with the shift handover when we transition from the morning shift to the afternoon shift or from the afternoon shift to the night shift. The platform helps seamlessly hand over from the previous analyst in the previous shift to the new analyst in the next shift.

My advice to other potential buyers of Cisco XDR would be to always conduct an evaluation or a proof of concept before actually purchasing because each environment is different and while Cisco XDR may be useful in most environments, there are potentially some environments where it may not be useful. It is always good to try before you buy. I would rate this product an eight out of ten.

Cisco XDR  is used for endpoint security, data protection across endpoints, network protection, advanced persistent threat (APT) detection, ransomware attack mitigation, and advanced threat detection. We use Data Loss Prevention (DLP)  because it integrates with Cisco Secure Access  and Cisco Umbrella , helping to protect sensitive data. Cisco XDR  is the extended detection and response solution we have implemented.

Cisco XDR  is appreciated as a SaaS-based platform for its user-friendliness with simple management tools that are easy for configuration. Its ability to reduce the Mean Time to Respond (MTTR) from hours to minutes and the option to use a customized dashboard are highly valued features.

The platform's AI-driven architecture, especially in Advanced Persistent Threat (APT) detection, is praised. Automation features streamline security operations by replacing manual and repetitive tasks.

Cisco XDR  offers comprehensive security by identifying visibility across the network and protecting cloud endpoints. It has significant performance metrics and scalability, designed to handle a large number of endpoints and sessions.

While Cisco XDR is robust, it could benefit from improvements on the AI side. More features could be added to prioritize and automate traffic.

We have been using Cisco XDR for more than two to three years.

We have not found any stability issues or received complaints from customers, so as of now, there is no improvement needed.

Cisco XDR is designed to handle significant scaling of endpoints, allowing management of a large scale of environments with thousands of sessions. It is rated nine out of ten for scalability.

The customer service response time is very good, with a strong technical team providing proper solutions when support is needed.

We previously used Cortex XDR  for Palo Alto. While the features are similar, Cisco XDR's AI-driven feature is more advanced, making it a better choice.

The deployment is considered simple and very user-friendly.

Cisco XDR has benefits on the user end and is easy to manage and deploy a large number of endpoints in a short time.

Alternate XDR solutions include Forcepoint and Zscaler.

As of now, there are no gaps identified, so I am not able to provide further advice. The review rating for Cisco XDR is nine out of ten.

As a security consultant, I use multiple SIEM  and XDR  solutions, so cumulatively, I can say I have used Cisco XDR  for around one year.

Cisco XDR  is built primarily for enterprise endpoint security, integrated onto endpoints with logs integrated into SIEM , and it is used for security investigations, malware impact investigation, and tracking particular security incidents through integration of different logs, where endpoint logs are very important, providing detail about processes run by potential malware and any call-outs made to command and control.

The best features of Cisco XDR  include its ability to integrate with multiple SIEM platforms, with visibility coming from a lot of Cisco's devices, and it syncs well with other XDRs and endpoint defenses such as Microsoft Defender, SentinelOne, and CrowdStrike, integrating well with other vendor products.

Cisco XDR helps prevent data loss during ransomware attacks by integrating with multiple levels of security, tying to identity management systems, and allowing placement of blocks at the endpoint level, which provides an additional layer of security, optimizing for detecting and preventing data loss based on how well the rules are placed and how well integrations are done for overall visibility of different stages of intrusion or data loss.

Improvements in Cisco XDR revolve around performance. The less performance it utilizes to run at high configuration levels, the better it becomes, so all vendors need to continue working on keeping resource utilization low while providing optimum performance, which is a defining point or deal breaker.

I have used Cisco XDR for around one year.

Stability is dependent on integration, since product-wise it is very stable, but performance-wise it is acceptable, so I would give it a rating of six.

In terms of scalability, I rate it as the best. For scalability, I would give it an eight out of ten.

I would rate technical support as a seven to eight because it is very great in current times. If I had to decide between seven or eight, I would say a seven.

I mostly use the AI assistance and automation feature for reporting, not for analysis because I do not trust AI for conclusions, only for inputs and reporting, which is how the AI component is utilized.

I do use the feature for prioritizing incidents across multiple security controls, but that needs to be configured, as I work mostly at the governance level for information security as a consultant, so the effectiveness depends on how well it is integrated and what the policy and operations are.

Cisco XDR streamlines incident response through its functionalities, being top of the stack and comparing well with other providers such as Palo Alto or the recently developed open-source Wazuh , which makes it very good.

I compare Cisco XDR with top-of-the-stack options available such as Palo Alto, Sophos XDR, and Secureye, an Indian company, and it lines up with all of them, providing a lot of other devices and software with Cisco's easy integration, making it one of the best for visibility.

I would definitely suggest Cisco XDR for enterprises and MSMEs who have a specified budget to fortify their defenses, and it stacks up well against other offerings in the market, naming CrowdStrike as somewhat better due to its knowledge base and R&D, with Tanium  ranking just under it, making Cisco XDR probably number three in the XDR market.

I rate this review overall as a seven out of ten.