Item: Cisco XDR
Rating: 7
Author: Verified User

Overall Satisfaction with Cisco XDR

Use Cases and Deployment Scope

We use Cisco XDR to detect threats and correlate suspicious activities to identify threat actors and where these activities are in the MITR kill chain. We use it for forensics when initiating an incident response team in response to a threat. Our 24/7 SOC leverages it to have visibility.

Pros and Cons

Pros

Providing visibility for threat risks
Detecting holes in the network that have vulnerabilites
Flagging ddos events and kicking off an incident response

Cons

XDR can improve with more integrations
XDR can be improved with more programmability for the end user
XDR can be improved with more options to mitigate events

Return on Investment

XDR helps contain a security incident event to reduce business impact
XDR provides real time visibility to alert the business on security risks
XDR provides ways to mitigate threats

Alternatives Considered

IBM Security QRadar EDR

Cisco XDR is great for companies that primarily run Cisco and provides a more seamless integration than Qradar both in terms of identify risks and mitigating them. Cisco XDR also provides insight through Cisco Talos and gives the end users ability to customize their work flow to threat hunt according to their business needs.

Key Insights

Do you think Cisco XDR delivers good value for the price?

Yes

Are you happy with Cisco XDR's feature set?

Yes

Did Cisco XDR live up to sales and marketing promises?

Yes

Did implementation of Cisco XDR go as expected?

Yes

Would you buy Cisco XDR again?

Other Software Used

IBM Security QRadar SIEM, Splunk Enterprise, Cisco Firepower 4100 Series

Likelihood to Recommend

I enjoy how well it integrates Cisco systems to provide a single pane of glass for security events that are easily digestible to the SOC. However there is room for improvement to integrate more seamlessly with non Cisco products. XDR is great to identify where malicious processes are in the MITR kill chain and is useful for threat analysis.

Comments

Please log in to join the conversation