Your SOC wants one place where a firewall connection event, a Snort alert, a Secure Endpoint detection and an Umbrella DNS request can appear on a single incident timeline for triage, while access-control policies stay under Management Center management. Which XDR integration design meets those needs?

Forwarding firewall connection events and Snort events to Cisco XDR meets the need: Secure Endpoint detections and Umbrella DNS requests can join those signals on a shared incident timeline, while access-control policies remain managed in Management Center. Forwarding connection, Snort, and endpoint events but leaving Umbrella DNS requests in Umbrella omits a required signal from the XDR timeline. Forwarding connection and Snort events to XDR and relying on endpoint and DNS signals to join the incident is the required design; these signals must be available there for correlation. Forwarding connection, Snort, and Umbrella DNS events but leaving endpoint detections in Secure Endpoint prevents those detections from joining the requested timeline. Forwarding Snort, endpoint, and Umbrella DNS events while retaining connection events in Management Center also leaves the timeline incomplete: Snort alerts do not replace the required connection-event data. Exam caveat: integration support and available event types can vary by product version, licensing, and configuration, and forwarding an alert does not necessarily forward every underlying event. Practical check: confirm that a test connection event, Snort alert, Secure Endpoint detection, and Umbrella DNS request each arrive in XDR and can be associated with the same incident, then verify that access-control policy administration remains in Management Center.