A retail SOC keeps separate consoles for Secure Firewall Management Center alerts, endpoint detections and network flow records, so analysts stitch timelines by hand during incidents. Leadership wants firewall intrusion and file events joined with endpoint and flow telemetry into risk-ranked incidents that one analyst can triage. Which Cisco capability should the team enable to correlate firewall events with the other telemetry sources?
Select an answer to reveal the explanation.
Short Explanation
Enable Cisco XDR to bring Secure Firewall events together with endpoint detections and flow records, then correlate them into risk-ranked incidents you can triage in one place. You avoid the SIEM option’s severity-based ranking, the SOAR option’s missing flow records, and the eStreamer option’s separate endpoint console.
Full Explanation
Integrating Secure Firewall with Cisco XDR fits the requirement because firewall intrusion and file events can join endpoint detections and network-flow records in a cross-source correlation engine. Cisco XDR can assemble related signals into risk-ranked incidents, giving you a consolidated place to triage instead of stitching timelines across separate consoles. The SIEM option includes all the telemetry, but its stated prioritization is by severity rather than risk score; severity alone does not provide the required risk ranking. The SOAR option correlates and risk-ranks cases, but it leaves network-flow records out, so the incident context is incomplete. The eStreamer option sends firewall events to a SIEM and enriches them with endpoint and flow telemetry, but analysts must pivot to a separate console for endpoint investigation, so it does not meet the single-workspace triage requirement. Exam caveat: distinguish a telemetry collection or transport method from a platform that correlates sources and ranks incidents; similar integrations do not necessarily provide the same workflow. Practical check: verify that a test incident includes firewall intrusion and file events, endpoint detections, and flow records, and that you can review and prioritize it in one workspace.