A single phishing campaign produces separate alerts in Cisco Secure Firewall, Cisco Secure Endpoint and Cisco Security Email Threat Defense. Analysts triage them one at a time and miss that they are linked. What capability addresses this?
Select an answer to reveal the explanation.
Short Explanation
Three alarms for one burglar shouldn't mean three separate investigations. XDR pulls the email, the endpoint and the firewall clues into one case file and tells you how urgent it is. Turning up the logging is the trap; more noise isn't the same as connecting the dots.
Full Explanation
Cisco XDR ingests detections and telemetry from integrated products, including Secure Firewall, Secure Endpoint, Email Threat Defense and third-party sources, and correlates them by shared observables such as hosts, users, file hashes, domains and IP addresses. Related detections are grouped into a single incident with a priority score that reflects factors such as asset value and detection confidence, so analysts see the attack chain, from the delivered email through execution on the endpoint to the outbound connection, rather than three unrelated alerts. Keeping separate per-product queues preserves the problem: each team sees part of the attack and nobody sees the whole chain. Increasing logging levels adds volume without linking events and can make alert fatigue worse. Forwarding alerts to a shared mailbox centralizes notification, but an inbox does not correlate observables, prioritize or show relationships, so analysts still connect the dots by hand. Exam caveat: correlation quality depends on integrations being enabled and on consistent identifiers across products, such as matching hostnames and user identities. Operational check: open the XDR incident for the campaign and confirm it lists the email, endpoint and firewall detections with their shared observables.