Cisco XDR Security Operations (XDROPS)

Price
$3,395.00 USD

Duration
3 Days

Cisco Learning Credit (CLC) Eligible

Delivery Methods
Virtual Instructor Led
Private Group

Request More Information

Download Course Details

Course Details Only
Course Details & Schedule

Skip to Class Dates

Course Overview

Cisco XDR Security Operations (XDROPS) is a 3-day training guiding you through the main aspects and challenges of traditional SOC. You will learn the Cisco XDR security platform and how it can simplify security operations in today\'s hybrid, multi-vendor, multi-threat landscape. Overview of all the main integration possibilities and components, including APIs discovery, Endpoint and Network Telemetry and ITSM, SIEM systems, and Public Cloud. Through expert instruction and hands-on lab exercises, you will learn how to read the components and work with Incident Manager for effective threat prioritization, streamlined investigations, and evidence-backed recommendations. In this training, you will discover how to elevate productivity with automation capabilities and boost your security resources for optimal value.

The course qualifies for 24 Cisco Continuing Education credits (CE) towards recertification.

Course Objectives

Understand the architecture of Cisco Secure Client/XDR.
Understand the Identification, Containment, Eradication, and Recovery Workflows.
Understand the XDR Remote Connector and how to accomplish arbitrary integrations.
Learn how to create automation using Automation APIs.
Recognize the types and sequence of Orchestration Workflows.
Understand the fundamentals of working with Public Cloud through XDR Orchestration.
Explain how to initiate Cisco XDR investigations from Splunk.

Who Should Attend?

Cisco integrators, resellers, and partners
Network administrators
Security administrators
Security consultants
Systems engineers
Cybersecurity engineers
Cybersecurity investigators
SOC analysts
Network design engineers
Solution architects

Top-rated instructors: Our crew of subject matter experts have an average instructor rating of 4.8 out of 5 across thousands of reviews.
Authorized content: We maintain more than 35 Authorized Training Partnerships with the top players in tech, ensuring your course materials contain the most relevant and up-to date information.
Interactive classroom participation: Our virtual training includes live lectures, demonstrations and virtual labs that allow you to participate in discussions with your instructor and fellow classmates to get real-time feedback.
Post Class Resources: Review your class content, catch up on any material you may have missed or perfect your new skills with access to resources after your course is complete.
Private Group Training: Let our world-class instructors deliver exclusive training courses just for your employees. Our private group training is designed to promote your team’s shared growth and skill development.
Tailored Training Solutions: Our subject matter experts can customize the class to specifically address the unique goals of your team.

Course Prerequisites

Working knowledge of the Windows and Linux operating systems.
Familiarity with basics of networking security concepts.
Technical understanding of TCP/IP networking and network architecture.
Technical understanding of security concepts and protocols.

The recommended Cisco offering may help you meet these prerequisites:

Implementing and Administering Cisco Solutions (CCNA)

Agenda

Module 1: Evolution and Introduction to Cisco XDR

Lesson 1: Detection and Response and the challenges of traditional SOC
Lesson 2: What is the OODA loop?
Lesson 3: Overview of Cisco XDR
High-level Architecture
Associating SOC profiles to XDR
Integrations and Response
XDR/EDR/MDR/SOAR/SIEM – Shared Use cases
Analytics and Correlation Engine

Module 2: Threat Detection and Incident Response Workflow

Lesson 1: Understanding Threat Detections with Diverse Intelligence
Lesson 2: How to read components: Judgement / Indicators / Feeds / Events
Lesson 3: Cisco XDR: Incident Manager
Threat inspection captured Incidents
Infrastructure-based Incident Prioritization: Detection Risk and Asset Value
MITRE
Correlated pictorial representation of the threat summary
Severity Management based on Event types
Identification/Containment/Eradication and Recovery Workflows

Module 3: Enrichment from Third-Party Integrations

Lesson 1: Overview of the third-party security landscape
Lesson 2: Built-in Integrations
EDR: Crowdstrike, Sentinel One, MSFT Defender, and more...
NDR: Dark Trace, Extrahop, and more...
Lesson 3: What is a Relay
Module?
Lesson 4: XDR: Remote Connector
Lesson 5: Accomplishing arbitrary integrations

Module 4: XDR APIs

Lesson 1: Northbound and Southbound APIs
Lesson 2: Threat Intelligence APIs: Private and public databases of threat intel
Lesson 3: Investigation APIs: Enrich data using your integrated products
Lesson 4: Response APIs
Lesson 5: OAuth APIs: Use credentials and get access tokens
Lesson 6: Automation APIs: Trigger workflows in XDR to do just about anything you want!

Module 5: XDR Automation and Orchestration

Lesson 1: Understanding Orchestration Workflows: Types and sequence
Lesson 2: Workflows Components: Targets, Account Keys, Triggers, Variables, Events, Schedules & Reports
Lesson 3: Constructing a basic workflow
Lesson 4: Exploring built in cisco and third-party service activities and logics
Lesson 5: Customizing out of the box workflows to fit the business use case
Lesson 6: Nesting workflows
Lesson 7: Using Microsoft APIs to investigate/detect suspicious email with Cisco Secure Email
Lesson 8: Enforcing DLP policy on outgoing email using Cisco XDR automation

Module 6: Endpoint and Network Telemetry

Lesson 1: Network and Endpoint Visibility Together: Telemetry + Device Insights
Lesson 2: Network Visibility
Module
Lesson 3: Cisco Secure Client/XDR: Architecture
Lesson 4: Reports and Audit logs
Lesson 5: Asset Tag Device Management

Module 7: Cisco XDR with ITSM, SIEM systems and Public Cloud

Lesson 1: Overview translation of Splunk CIM to XDR CTIM
Lesson 2: Initiating Cisco XDR investigation from Splunk
Lesson 3: Splunk and Cisco XDR Webhooks or Atomic Actions
Lesson 4: Overview of Cisco XDR and Service Now Integration
Lesson 5: Adding Context to ServiceNow incident – Using XDR Automate
Lesson 6: Fundamentals of working with Public Cloud with XDR Orchestration

Get in touch to schedule training for your team
We can enroll multiple students in an upcoming class or schedule a dedicated private training event designed to meet your organization’s needs.