A security team runs Secure Firewall Threat Defense at the edge, endpoint protection on servers, and a mail gateway, each on its own console, with no spare data engineers to build and maintain custom log parsers. They need a single incident that ties supported firewall alerts to endpoint and email findings, with response actions across all three domains. Which platform should the team use to correlate the firewall events with that other telemetry?
Select an answer to reveal the explanation.
Short Explanation
You have three consoles holding pieces of one story, and somebody has to stitch them together. Cisco XDR can correlate supported firewall alerts with endpoint and email findings when the relevant integrations are configured, presenting related signals in an incident. It works like a detective's corkboard where clues from every department land in one place.
Full Explanation
Cisco XDR is the best fit because the requirement is not simply to collect logs: the team needs supported Secure Firewall, endpoint, and email alerts correlated into one incident, with response actions spanning all three domains. With the relevant integrations configured, Cisco XDR provides that cross-domain workflow without requiring the team to build and maintain custom log parsers. Management Center remains useful for managing Secure Firewall and acting on firewall events, but it does not provide the required unified incident across endpoint and email findings. A SIEM can ingest and correlate all three feeds and automate response, but the proposed approach depends on engineers building and maintaining custom parsers; that conflicts with the stated lack of data-engineering capacity. An endpoint-focused XDR may offer useful cross-domain correlation, yet if its response automation is limited to endpoint containment, it cannot meet the requirement for actions across firewall, endpoint, and email. Exam caveat: product capabilities depend on licensing, supported integrations, and configuration, so distinguish a platform’s potential integrations from the specific supported alert and response workflows available in the deployment. Practical check: verify that each source is connected, that representative firewall, endpoint, and email alerts appear together in a test incident, and that the intended response actions are available and authorized for each domain.