Detection and Response with XDR: Integrated Security Solutions to Combat Emerging Threats

Detection and Response with XDR: Integrated Security Solutions to Combat Emerging Threats

by Steven McNutt / Katherine McNamara / Matt Vander Horst
Released November 2024
Publisher(s): Cisco Press
ISBN: 0135345642

Watch it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Video description

6+ Hours of Video Instruction

Stay ahead of evolving security threats by mastering eXtended Detection and Response (XDR)

Modern security operations face a rapidly evolving threat landscape, making it difficult to gain complete visibility across disparate security tools. Detection and Response with XDR: Integrated Security Solutions to Combat Emerging Threats introduces learners to how XDR can bridge that gap by centralizing telemetry, intelligence, and response capabilities from a variety of sources into a single platform.

In this comprehensive video course, you’ll discover why XDR is a game-changer in reducing detection and response times, explore how XDR optimizes security operations, and learn practical strategies to implement XDR in your organization. This course provides the necessary skills to design, implement, and automate threat responses using cutting-edge XDR technology.

About the Instructors

Steven (Steve) McNutt, CCIE #6495 (Enterprise Infrastructure, Security), M.S. Cybersecurity, and DevNet Professional is a Cybersecurity Technical Solutions Architect for Cisco. He’s presented on XDR Orchestration at Cisco Live multiple times. Steve is a member of the Security Programmability Team (SPOT), which develops and delivers training content around Security Programmability. Steve has been in the Information Technology business since 1995 in various roles, including individual contributor, management, and business founder/owner.

Katherine McNamara, CCIE No. 50931, is a Cybersecurity Technical Solutions Architect at Cisco Systems and has worked with large enterprise and public sector customers. Katherine joined Cisco in 2014 and has worked in IT since 2007 in multiple networking and security roles. She graduated with a Bachelor of Science in IT Security and a Master of Science in Information Security and Assurance. Her many certifications include CCIE Data Center, CCIE Security, MCSE, VCP, CISSP, CCNP, CCDP, and more.

Outside of her day job, she runs a blog called network-node.com, which provides training articles and videos about Cisco Security products. She also helps co-organize the largest Cisco study Meetup group in the world named Routergods.

Matt Vander Horst is a Technical Leader in Cisco’s Security Business Group focused on Cisco XDR. He’s a subject matter expert for XDR automation and is responsible for helping Cisco engineers, customers, and partners get the most value out of XDR. Matt has hosted a multitude of webinars and deep dives about XDR, has presented about XDR at conferences around the globe, and currently manages the automation content built into XDR and the XDR Automation Exchange. Prior to joining Cisco in early 2020, Matt spent eight years managing a Cisco Identity Services Engine (ISE) deployment and network infrastructure automation for a large international financial organization. His background includes network engineering, system administration, software development, and DevOps.

Skill Level

  • Beginner
  • Intermediate

Learn How To

  • Identify modern cybersecurity threats and vulnerabilities
  • Understand how XDR enhances visibility across products and technologies
  • Utilize XDR’s investigation features to detect and manage breaches
  • Leverage automation to isolate and remediate threats swiftly

Prerequisites

  • Basic understanding of cybersecurity concepts
  • Familiarity with SOC tools such as SIEM, IDS/IPS, and firewalls
  • Experience in a security operations role (for example, security analyst or incident responder)

Who Should Take This Course

Job titles:

  • SOC Analyst
  • Incident Responder
  • Security Engineer
  • Security Operations Manager
  • Security Architect
  • CISO (Chief Information Security Officer)
  • Network Security Engineer
  • Threat Hunter
  • Penetration Tester
  • Security Automation Specialist
  • IT Manager with Security Focus

About Pearson Video Training

Pearson publishes expert-led video tutorials covering a wide selection of technology topics designed to teach you the skills you need to succeed. These professional and personal technology videos feature world-leading author instructors published by your trusted technology brands: Addison-Wesley, Cisco Press, Pearson IT Certification, Sams, and Que. Topics include IT Certification, Network Security, Cisco Technology, Programming, Web Development, Mobile Development, and more. Learn more about Pearson Video training at http://www.informit.com/video.

Table of contents

  1. Introduction
    1. Detection and Response with XDR: Introduction
  2. Module 1: Security Operations and Tooling
    1. Module Introduction
  3. Lesson 1: The Modern Security Operations Center
    1. Learning objectives
    2. 1.1 Describe the Goals of the SOC
    3. 1.2 Describe SOC Organization
    4. 1.3 Describe SOC Roles and Responsibilities
    5. 1.4 Describe SOC Process Flow
  4. Lesson 2: Security Operations Concepts and Tooling
    1. Learning objectives
    2. 2.1 Describe Basics of NIST Cybersecurity Framework (CSF)
    3. 2.2 Describe Major Categories of Threats
    4. 2.3 Describe Major Categories of Controls
    5. 2.4 Identify Some Popular Open-Source Tools and Their Functions
  5. Lesson 3: Computer Security Incident Response Teams (CSIRT)
    1. Learning objectives
    2. 3.1 Describe the Goals of a CSIRT
    3. 3.2 Appreciate the Differences Between a SOC and a CSIRT
  6. Module 2: Extended Detection and Response (XDR)
    1. Module Introduction
  7. Lesson 4: Trends and Challenges
    1. Learning objectives
    2. 4.1 Describe the Limitations of Existing Solutions
    3. 4.2 Identify Some of the Top Roadblocks with Existing Tools
    4. 4.3 Describe the Limitations with SIEMs
    5. 4.4 Describe the Limitations with SOARs
  8. Lesson 5: Introducing XDR
    1. Learning objectives
    2. 5.1 Describe the Basics of XDR
    3. 5.2 Describe the Goals of XDR
    4. 5.3 Describe Cisco's Secure Approach to XDR
    5. 5.4 Identify the Components of XDR
    6. 5.5 Appreciate XDR's Differences from a SIEM and SOAR
    7. 5.6 Describe XDR's Real-World Outcomes
  9. Lesson 6: XDR's Integrated Security Stack
    1. Learning objectives
    2. 6.1 Identify the Goals of an Integrated Security Stack
    3. 6.2 Appreciate XDR's Native and Third-Party Compatibility
    4. 6.3 Describe XDR's REST APIs
    5. 6.4 Describe XDR's Detection Analytics
    6. 6.5 Describe XDR's Remediation Capabilities
    7. 6.6 Describe XDR's Orchestration/Automation Capabilities
    8. 6.7 Describe an Effective XDR Solution
  10. Module 3: XDR with Cisco
    1. Module Introduction
  11. Lesson 7: Threat Hunting
    1. Learning objectives
    2. 7.1 Describe the PICERL Model
    3. 7.2 Describe the MITRE Framework
    4. 7.3 Describe Adversary Tactics, Techniques, and Procedures (TTPs)
    5. 7.4 Identify the Tools and Techniques for Threat Hunting
  12. Lesson 8: Investigating an Incident
    1. Learning objectives
    2. 8.1 Describe an Incident in XDR
    3. 8.2 Describe Incident Priority and MITRE Tactics
    4. 8.3 Identify the Components of an Incident
    5. 8.4 Interact with Cisco XDR's Attack Graph
    6. 8.5 Identify Correlating Data Using XDR
  13. Lesson 9: Responding to an Incident
    1. Learning objectives
    2. 9.1 Appreciate the Value of Cisco XDR Integrations for Response
    3. 9.2 Describe How XDR Can Respond to an Incident
    4. 9.3 Understand Incident Response Playbooks
  14. Module 4: Security Automation
    1. Module Introduction
  15. Lesson 10: What Is Security Automation?
    1. Learning objectives
    2. 10.1 Describe the Advantages of Security Automation
    3. 10.2 Describe the Roles of AI and Machine Learning
  16. Lesson 11: How Does Automation Fit into XDR?
    1. Learning objectives
    2. 11.1 Understand Threat Hunting and Alert Investigation
    3. 11.2 Describe Response Actions
  17. Lesson 12: Cisco XDR Automation
    1. Learning objectives
    2. 12.1 Describe XDR Automation and Its Usage
    3. 12.2 Explain Automation Components
    4. 12.3 Explore the Workflow Editor
    5. 12.4 Explain a Workflow Run and Troubleshooting
  18. Summary
    1. Detection and Response with XDR: Summary

Product information

  • Title: Detection and Response with XDR: Integrated Security Solutions to Combat Emerging Threats
  • Author(s): Steven McNutt / Katherine McNamara / Matt Vander Horst
  • Release date: November 2024
  • Publisher(s): Cisco Press
  • ISBN: 0135345642