Module 1: Evolution and Introduction to Cisco XDR

1. Detection and Response and the challenges of traditional SOC

2. What is the OODA loop?

3. Overview of Cisco XDR

4. High-level Architecture

5. Associating SOC profiles to XDR

6. Integrations and Response

7. XDR/EDR/MDR/SOAR/SIEM – Shared Use cases

8. Analytics and Correlation Engine

Module 2: Threat Detection and Incident Response Workflow

1. Understanding Threat Detections with Diverse Intelligence

2. How to read components: Judgement / Indicators / Feeds / Events

3. Cisco XDR: Incident Manager

4. Threat inspection captured Incidents

5. Infrastructure-based Incident Prioritization: Detection Risk and Asset Value

6. MITRE

7. Correlated pictorial representation of the threat summary

8. Severity Management based on Event types

9. Identification/Containment/Eradication and Recovery Workflows

Module 3: Enrichment from Third-Party Integrations

1. Overview of the third-party security landscape

2. Built-in Integrations

3. EDR: Crowdstrike, Sentinel One, MSFT Defender, and more...

4. NDR: Dark Trace, Extrahop, and more...

5. What is a Relay Module?

6. XDR: Remote Connector

7. Accomplishing arbitrary integrations

Module 4: XDR APIs

1. Northbound and Southbound APIs

2. Threat Intelligence APIs: Private and public databases of threat intel

3. Investigation APIs: Enrich data using your integrated products

4. Response APIs

5. OAuth APIs: Use credentials and get access tokens

6. Automation APIs: Trigger workflows in XDR to do just about anything you want!

Module 5: XDR Automation and Orchestration

1. Understanding Orchestration Workflows: Types and sequence

2. Workflows Components: Targets, Account Keys, Triggers, Variables, Events, Schedules & Reports

3. Constructing a basic workflow

4. Exploring built in cisco and third-party service activities and logics

5. Customizing out of the box workflows to fit the business use case

6. Nesting workflows

7. Using Microsoft APIs to investigate/detect suspicious email with Cisco Secure Email

8. Enforcing DLP policy on outgoing email using Cisco XDR automation

Module 6: Endpoint and Network Telemetry

1. Network and Endpoint Visibility Together: Telemetry + Device Insights

2. Network Visibility Module

3. Cisco Secure Client/XDR: Architecture

4. Reports and Audit logs

5. Asset Tag Device Management

Module 7: Cisco XDR with ITSM, SIEM systems and Public Cloud

1. Overview translation of Splunk CIM to XDR CTIM

2. Initiating Cisco XDR investigation from Splunk

3. Splunk and Cisco XDR Webhooks or Atomic Actions

4. Overview of Cisco XDR and Service Now Integration

5. Adding Context to ServiceNow incident – Using XDR Automate

6. Fundamentals of working with Public Cloud with XDR Orchestration