A retail SOC keeps seeing blocked outbound connections on its Secure Firewall Threat Defense and needs to know whether any workstation reached the command server before the block. Endpoint and identity alerts also arrive every day in separate consoles. Which Cisco XDR capability gives analysts one cross-telemetry investigation view?

Cisco XDR is the cross-telemetry investigation capability: through product integrations, it can normalize Management Center firewall events alongside endpoint and identity signals so you can investigate them in a shared incident view. Firewall event details can help you determine whether a connection was allowed or blocked, but XDR does not guarantee every source will contribute to the same incident or timeline. An FMC correlation policy evaluates firewall data against a correlation object and raises an alert in the Management Center; it can flag matching events there, but it does not provide the requested investigation across firewall, endpoint, and identity telemetry. A Management Center connection search filtered by destination address can help answer whether a particular session completed, but it is a session lookup rather than a shared cross-telemetry investigation view. Secure Endpoint isolation is a response action, and its endpoint events remain in its own console; isolation does not bring the firewall and identity signals into one investigation. Exam caveat: available XDR sources and integrations can change, so confirm the currently supported list. Practical check: in a lab, trigger a blocked outbound connection and verify whether the relevant firewall event appears in an XDR incident alongside the available endpoint and identity signals.