In this stage, the customer will:

• Become familiar with Cisco XDR Platform
• Log into the Cisco XDR Portal and activate their enterprise
• Prepare intelligence sources for integration with Cisco XDR
• Integrate EDR modules and SCA with Cisco XDR
• Configure Cisco XDR dashboards
• Provision additional admin or incident responder accounts

The customer will exit this stage when they have:

• Successfully claimed their Cisco XDR subscription, logged into the Cisco XDR Portal, and activated their enterprise
• Integrated Endpoint Solution modules and Security Cloud Analytics with Cisco XDR
• Provisioned additional admin or incident responder accounts

Ensure your customer is:

• Logging into Cisco XDR Portal successfully
• Set up within their correct region under "My Account" within the platform
• Exploring modular content associated with onboarding the Cisco XDR Platform
• Familiar with Cisco and third-party integrations and validate that individual integrations are adopted individually. A customer won't receive incidents in the dashboard until their product integration is adopted.

In this stage, the customer will:

• Log into Cisco XDR and verify their role under "My Accounts"
• Add users by going to "Administration" and "Manage Users"
• Enable integrations by selecting "Get Started" followed by "Enable"
• Complete the form in the "Add Integration" area by clicking "Add Integration"

The customer will exit this stage when they have:

• Enabled at least one integration to allow incidents to flow
• Logged into Cisco XDR Platform (at least five times every 30 days)
• Reviewed the Cisco XDR Incidents List (at least five times in the last 30 days)

Ensure your customer is:

• Aware that only users with an Administrator role can add integrations
• Adding additional admins to prevent lockout
• Aware that to begin seeing incidents and respond to key events within Cisco XDR, at least one integration must be added
• Starting with the Endpoint Solution
• Planning to integrate Secure Cloud Analytics (SCA) by following the SCA integration guide
• Logging into Cisco XDR Platform five or more times every 30 days
• Logging into the "Incidents" page five times or more in the last 30 days

In this stage, the customer will:

• Log into Cisco XDR Platform (at least five times every 30 days)
• Review incidents that have been promoted by Cisco XDR
• Review incident details within the "Detection" page and use the response tasks to identify, contain, and restore systems post-threat
• Prioritize specific incidents, assets, and establish baselines
• Review correlated incidents within the "Incidents" menu (at least five times in the last 30 days)
• Continue to add integrations with Cisco XDR (three or more)

The customer will exit this stage when they have:

• Reviewed incidents five or more times in the last 30 days
• Run investigations on five or more days in the last 30 days
• Continued to integrate

Ensure your customer is:

• Exploring the "Incidents" modular video associated with adopting the Cisco XDR platform
• Reviewing correlated incidents within the "Incidents" menu (at least five times in the last 30 days)
• Running investigations on five or more days in the last 30 days
• Continuing to add new integrations into Cisco XDR

In this stage, the customer will:

• Actively engage with incidents within the Cisco XDR Dashboard
• Demonstrate how to remediate and respond to incidents as well as identify potential product gaps in the security infrastructure
• Expand their knowledge around playbooks with the Cisco XDR Dashboard
• Create custom playbooks that align to their specific business needs

The customer will exit this stage when they have:

• Created a custom playbook and assigned it to a specific incident
• Viewed the "Incident Response" page to expand incidents feature usage OR launched an investigation from any individual incident (on five or more days in the last 30 days)
• Run investigations on five or more days in the last 30 days
• Integrated an additional two or more modules with Cisco XDR

Ensure your customer is:

• Understanding the value of Custom Playbooks
• Using the custom playbooks to guide incident response to effectively identify, contain, and eradicate the threat, and then restore systems to recover from the threat
• Aware that the custom playbooks include a collection of tasks for all phases of incident response
• Aware that until a custom playbook is created, the default Cisco-managed playbook will be assigned to all new incidents

In this stage, the customer will:

• Deploy a Cisco NVM Profile from the Cisco XDR Secure Client Cloud Connector
• Run investigations on five or more days in the last 30 days
• Integrate an additional two or more modules with Cisco XDR
• Expand incidents feature usage by viewing the "Incident Response" page OR launching an investigation from any individual incident (on five or more days in the last 30 days)
• Attempt to run at least one automation workflow in the last 30 days
• Visit the "Assets" page

The customer will exit this stage when they have:

• Effectively deployed a Cisco NVM Profile
• Viewed the "Incident Response" page to expand incidents feature usage OR launched an investigation from any individual incident (on five or more days in the last 30 days)
• Run investigations on five or more days in the last 30 days
• Added at least two or more new modules to integrate with Cisco XDR

Ensure your customer is:

• Deploying a Secure Client Profile with NVM - this allows the customer to know which incidents should be prioritized over other incidents based on the risk score of each incident.
• Visiting the "Incident Response" page within an individual incident OR launching investigations from an individual incident (on five days in the last 30 days)
• Running investigations on five or more days in the last 30 days
• Integrating an additional two or more modules into Cisco XDR, in addition to the Endpoint Detection and Response module(s) that generate incidents (Secure Endpoint, CrowdStrike, Microsoft Defender for Endpoint, and SCA)