A SOC monitors FTD devices at two sites and also collects alerts from the email gateway and endpoint agents, yet each tool shows only part of the attack. They want one investigation that links firewall events to endpoint, identity, and email data through shared indicators. Which platform provides that cross-domain correlation?
Select an answer to reveal the explanation.
Short Explanation
A correlation engine that can join firewall hits with endpoint, identity, and email signals is what you need, and that is Cisco XDR's job. FMC correlation rules focus on events available to the Management Center, exporting logs leaves the joining to a person, and eStreamer is a feed rather than a correlator. It's the difference between a detective who canvasses every witness and one who reads a single desk's reports.
Full Explanation
Cisco XDR can ingest detections from integrated products, including Secure Firewall events, alongside endpoint, identity, DNS, email, and network telemetry. Its correlation capabilities can group related findings using observables such as IP addresses, hostnames, usernames, hashes, or URLs into an incident with a timeline and attack graph. This meets the requirement when the relevant integrations are configured: firewall events can be linked to findings from other sources rather than joined by hand. FMC correlation rules evaluate events available to the Management Center and do not by themselves provide the requested cross-domain correlation with endpoint, identity, and email data. Exporting connection events to a log tool places records side by side but leaves the joining of indicators to an analyst. eStreamer is an event feed from the Management Center, not a cross-domain correlation engine. Practical check: investigate a recent source IP in XDR and confirm that findings from the expected integrations are available.