Cisco XDR Reviews

We are a small ISP, and it mainly use it just basically for routing and insights into wherever our traffic goes through.

My job is to put out fires all day. The features of Cisco XDR benefit my company since time is money. When outages happen and when a customer can't reach the internet, they get agitated. Therefore, the quicker we can mitigate an issue, our customers get happier in a quicker fashion.

I appreciate the granularity of what I get from Cisco XDR the most. It provides so much information that I can troubleshoot in a more detailed fashion. I get all this information and can comb through it to figure out exactly where the source of the trouble comes from. 

Between the clarity, the granularity, and the dashboard, it just works.

It does its job by helping evaluate gaps and mitigating in a timely fashion. 

Cisco XDR can be improved by addressing the upfront cost. Everything matters for us since we're small, mom and pop, so every dollar counts.

I have been using Cisco XDR for about two years, two and a half years.

The stability and reliability of Cisco XDR, similar to most Cisco products, are bulletproof. As long as I keep it with ramp patching and updates, they just work.

Regarding scalability, since we're smaller, I don't know if we'll ever grow bigger than what we are now, being landlocked in Bixby, Oklahoma. However, if we were blessed to get bigger, it would be easy.

My experience with customer service and technical support for Cisco XDR is that the tech support is excellent and easy to work with.

I considered other solutions before choosing Cisco XDR, such as FortiGate and Juniper, and those were two that we had a proof of concept with. FortiGate was good, but it was actually a blessing because Cisco XDR was technically cheaper than FortiGate.

My experience with the deployment of Cisco XDR is that it was extremely easy. We worked with our VAR, Net Fabric.

The representative we worked with helped us set it up and it just worked.

The biggest return on investment when using Cisco XDR is that, being a small company where everybody has multiple roles, the quicker I can mitigate something, the faster I can return to my scheduled tasks for that day.

My experience with the costs, including setup costs and licensing for Cisco XDR, is that it's now a subscription base, with options for one year, three year, or five year terms. 

It would be preferable to return to the old model where you just buy it once without having to pay a renewing fee, however, I don't think they're going to implement that.

I considered other solutions before choosing Cisco XDR, such as FortiGate and Juniper, and those were two that we had a proof of concept with. FortiGate was good, however, it was actually a blessing because Cisco XDR was technically cheaper than FortiGate.

Cisco XDR streamlines incident response through its provided functionalities because, based on the clarity of the dashboard and the granularity, it works effectively. 

I would rate Cisco XDR overall a nine out of ten, based on the price point.

I use Cisco XDR for detection and response. I have an Insight license from Cisco XDR, which provides me with a powerful GUI on the cloud where I can see comprehensive insights from my machines. I also have an MDR service license from Cisco.

I use Cisco XDR for prioritizing incidents across multiple security controls. The second-best technical feature is incident correlation, which provides me centralized visibility and a single place to review incidents and investigate IPs, URLs, and domains. All log data is visible on one dashboard for managing incidents and taking actions with integrations and connectors to other products in my organization.

I have not yet run the DLP feature in Cisco XDR, but the XDR forensics capability provides evidence collection and forensics visibility, which works very well with incident correlation. Regarding DLP, I run an endpoint from Kaspersky, not Cisco. The integrations are strong, and I have purchased integrations from Cisco.

I have used the automation feature in Cisco XDR to improve workflows. I have connectors and direct integrations that allow Cisco to integrate with my firewalls using predefined integrations. I enable collectors and have connected firewalls, endpoints, and email systems, which allows me to take actions. For example, during a phishing incident, I run automations to investigate domains that trigger a phishing email, and I can block this domain on my email system through integration with Cisco XDR.

Cisco XDR has helped expose gaps in my security coverage. Since implementing it, I did not have NDR, and I opened a conversation with Cisco to implement the Cisco NDR module, which will be very useful to integrate with Cisco XDR. I receive detailed reports on traffic flow, so I can see on the Cisco XDR dashboard when user X attempts to connect to a malicious domain, for example.

The best feature of Cisco XDR, on which I based my decision to purchase it, is that Cisco XDR does not require an endpoint from Cisco. It can work with any endpoint. In my situation, I have an endpoint from Kaspersky, and Cisco XDR can integrate with it. It has predefined integrations based on the licensing model, so there is no need to have a Cisco endpoint to use Cisco XDR. This is not the typical use case for other XDR solutions like Trend Micro or Palo Alto Cortex, where you must obtain the endpoint from the same vendor.

In just four months, I have seen a good return on investment with Cisco XDR. I have reduced incidents and saved time because previously, if I encountered any incident, I would have spent considerably more time and effort reaching out to every security control on my network and checking logs across multiple systems. With Cisco XDR, I gain visibility on one dashboard where I can see extensive logs, resulting in time saved and reduced security incidents, which provides a strong return on my investment.

I believe the advanced insights module in Cisco XDR has room for improvement because it requires a separate license. If Cisco allowed me to access full data with a basic license, it would benefit many customers.

I have used Cisco XDR for four months.

I assess the stability of Cisco XDR as ten out of ten.

Although I have not yet tested scalability, I can say that theoretically it appears to support scalability, so I would rate it as ten out of ten.

I rate the technical support from Cisco as very professional with a strong support team. It is Cisco TAC, so I would rate it as ten out of ten.

Positive

The deployment of Cisco XDR is very simple and straightforward. I access the service, check the service, configure it, and I obtain the dashboard to begin configuring integrations. I receive logs and can take actions based on incidents easily.

In just four months, I have seen a good return on investment with Cisco XDR. I have reduced incidents and saved time because previously, if I encountered any incident, I would have spent considerably more time and effort reaching out to every security control on my network and checking logs across multiple systems. With Cisco XDR, I gain visibility on one dashboard where I can see extensive logs, resulting in time saved and reduced security incidents, which provides a strong return on my investment.

I believe the pricing of Cisco XDR is affordable compared to other solutions.

I believe Cisco XDR compares favorably with other XDR solutions such as Cortex XDR and Trend Micro Vision One. The best feature, as I mentioned earlier, is that Cisco XDR does not require its own endpoint. I have a Kaspersky endpoint, and I did not need an endpoint from Cisco to use Cisco XDR. In contrast, with other vendors such as Cortex or Trend Micro, you must obtain the same vendor endpoint.

My advice for others looking to implement Cisco XDR is to establish licensing agreements beforehand and list your products for integration with Cisco XDR. You need to know which email systems, DLP solutions, firewalls, and vendors you will use, as this helps identify the best licensing for your needs.

Regarding how many people use the solution, I can say that we are running it on our SOC, which has multiple shifts and approximately eight SOC analysts.

Cisco XDR does not require any maintenance, as this is provided by Cisco. My overall rating for Cisco XDR is ten out of ten.

I use Cisco XDR to automate all the threats which are coming in. It automatically isolates the particular endpoints, whether it's a laptop or a server. That helps and provides a good quality report which helps us to identify and then analyze according to it.

I have SIEM tools of CrowdStrike. I have third-party tools such as endpoints of Trellix endpoints and SentinelOne as well. I integrate this from this integration to Cisco XDR, and I can see all the reports on a single dashboard.

Cisco XDR helps to detect the threats in my organization. It prioritizes most of the critical incidents and responds to them faster as well.

Cisco XDR generates the alerts and reduces the false positive reports. It prioritizes automatically the risk and the impact which will be happening on my organization. It also helps the SOC team to act faster due to the automation.

The best features Cisco XDR offers are threat detection, incident response, automated investigation, and integration. There are many third-party tools which I can integrate with Cisco XDR.

I believe the false positive reports can be reduced through AI automation, as well as the duration while loading the software. I believe that is lacking.

I chose nine because we have to reduce the false positive reports and the time taken to load a page. That's the reason I gave the nine.

I have been using Cisco XDR for the past three years.

Cisco XDR is stable.

The scalability of Cisco XDR is good. I would say nine.

I believe customer support is also good.

We have not switched. Cisco XDR is the first solution we implemented. We took the POC and it was good to go.

I evaluated Cortex before choosing Cisco XDR.

I believe Cisco XDR is good and I think I can also recommend it to most of the companies to just try it out once to have a POC, just to make sure all the things get under control in a single dashboard. You have to try it once. So far, everything is going well. I gave this product a rating of nine out of ten.

Cisco XDR is used for endpoint security, data protection across endpoints, network protection, advanced persistent threat (APT) detection, ransomware attack mitigation, and advanced threat detection. We use Data Loss Prevention (DLP) because it integrates with Cisco Secure Access and Cisco Umbrella, helping to protect sensitive data. Cisco XDR is the extended detection and response solution we have implemented.

Cisco XDR is appreciated as a SaaS-based platform for its user-friendliness with simple management tools that are easy for configuration. Its ability to reduce the Mean Time to Respond (MTTR) from hours to minutes and the option to use a customized dashboard are highly valued features.

The platform's AI-driven architecture, especially in Advanced Persistent Threat (APT) detection, is praised. Automation features streamline security operations by replacing manual and repetitive tasks.

Cisco XDR offers comprehensive security by identifying visibility across the network and protecting cloud endpoints. It has significant performance metrics and scalability, designed to handle a large number of endpoints and sessions.

While Cisco XDR is robust, it could benefit from improvements on the AI side. More features could be added to prioritize and automate traffic.

We have been using Cisco XDR for more than two to three years.

We have not found any stability issues or received complaints from customers, so as of now, there is no improvement needed.

Cisco XDR is designed to handle significant scaling of endpoints, allowing management of a large scale of environments with thousands of sessions. It is rated nine out of ten for scalability.

The customer service response time is very good, with a strong technical team providing proper solutions when support is needed.

We previously used Cortex XDR for Palo Alto. While the features are similar, Cisco XDR's AI-driven feature is more advanced, making it a better choice.

The deployment is considered simple and very user-friendly.

Cisco XDR has benefits on the user end and is easy to manage and deploy a large number of endpoints in a short time.

Alternate XDR solutions include Forcepoint and Zscaler.

As of now, there are no gaps identified, so I am not able to provide further advice. The review rating for Cisco XDR is nine out of ten.

Our main use case for Cisco XDR is to centralize security telemetry and correlated events across endpoints, the network, and email security tools. This solution helps us detect threats faster, reduce alert noise, and improve investigation efficiency.

Recently, a phishing email triggered an alert in Cisco XDR through email security, while the endpoint detected suspicious execution. The firewall logged unusual traffic, and Cisco XDR correlated all signals into a single incident, showing the full attack chain.

The best features Cisco XDR offers are cross-domain visibility, encompassing endpoint, network, and email in one place, and incident prioritization, which highlights high-risk events.

The threat correlation that links related alerts automatically is the feature I rely on the most because it converts multiple alerts into one actionable incident, which has significantly reduced investigation time.

Cisco XDR has positively impacted our organization by providing faster detection of complex threats, reducing alert fatigue, and giving us better visibility.

Cisco XDR is working well, but the solution could be more cost-effective for mid-sized and small organizations. Apart from this consideration, everything is excellent.

I have been using Cisco XDR for more than three years.

I highly recommend Cisco XDR, and my advice would be to deploy this solution by integrating the maximum number of security tools for full visibility and to start with key use cases. It is important to train your SOC team so that they can effectively handle this solution. I am providing this review with a rating of eight out of ten.

As a security consultant, I use multiple SIEM and XDR solutions, so cumulatively, I can say I have used Cisco XDR for around one year.

Cisco XDR is built primarily for enterprise endpoint security, integrated onto endpoints with logs integrated into SIEM, and it is used for security investigations, malware impact investigation, and tracking particular security incidents through integration of different logs, where endpoint logs are very important, providing detail about processes run by potential malware and any call-outs made to command and control.

The best features of Cisco XDR include its ability to integrate with multiple SIEM platforms, with visibility coming from a lot of Cisco's devices, and it syncs well with other XDRs and endpoint defenses such as Microsoft Defender, SentinelOne, and CrowdStrike, integrating well with other vendor products.

Cisco XDR helps prevent data loss during ransomware attacks by integrating with multiple levels of security, tying to identity management systems, and allowing placement of blocks at the endpoint level, which provides an additional layer of security, optimizing for detecting and preventing data loss based on how well the rules are placed and how well integrations are done for overall visibility of different stages of intrusion or data loss.

Improvements in Cisco XDR revolve around performance. The less performance it utilizes to run at high configuration levels, the better it becomes, so all vendors need to continue working on keeping resource utilization low while providing optimum performance, which is a defining point or deal breaker.

I have used Cisco XDR for around one year.

Stability is dependent on integration, since product-wise it is very stable, but performance-wise it is acceptable, so I would give it a rating of six.

In terms of scalability, I rate it as the best. For scalability, I would give it an eight out of ten.

I would rate technical support as a seven to eight because it is very great in current times. If I had to decide between seven or eight, I would say a seven.

Positive

I mostly use the AI assistance and automation feature for reporting, not for analysis because I do not trust AI for conclusions, only for inputs and reporting, which is how the AI component is utilized.

I do use the feature for prioritizing incidents across multiple security controls, but that needs to be configured, as I work mostly at the governance level for information security as a consultant, so the effectiveness depends on how well it is integrated and what the policy and operations are.

Cisco XDR streamlines incident response through its functionalities, being top of the stack and comparing well with other providers such as Palo Alto or the recently developed open-source Wazuh, which makes it very good.

I compare Cisco XDR with top-of-the-stack options available such as Palo Alto, Sophos XDR, and Secureye, an Indian company, and it lines up with all of them, providing a lot of other devices and software with Cisco's easy integration, making it one of the best for visibility.

I would definitely suggest Cisco XDR for enterprises and MSMEs who have a specified budget to fortify their defenses, and it stacks up well against other offerings in the market, naming CrowdStrike as somewhat better due to its knowledge base and R&D, with Tanium ranking just under it, making Cisco XDR probably number three in the XDR market.

I rate this review overall as a seven out of ten.

We use Cisco XDR for our network devices and data centers, as we are an internet provider. We deliver the internet to customers.

The feature I appreciate the most about Cisco XDR is the reliability. The reliability of Cisco XDR benefits my company by ensuring less downtime and less customer downtime, and it is also easier to keep everyone trained on Cisco because we are all more familiar with that than other vendors. 

My only complaint about Cisco XDR is related to licensing, which is complicated. 

I have been using Cisco XDR for probably three years.

Cisco XDR is very reliable, which is its big advantage.

Cisco XDR scales effectively with the growing needs of my company.

My experience with their technical support has been excellent. I would rate Cisco customer service a ten out of ten.

Positive

It is easy to implement.

The biggest return on investment when using Cisco XDR is the downtime aspect, specifically not having to roll out to sites and not having customers experience downtime.

I don't have the metrics, but the downtime reduction is definitely a lot compared to the other vendors that we've used in the past.

The licensing of Cisco XDR is a bit complicated. The cost can depend on what it is, and the process can be a little complicated. 

We did consider other solutions before choosing Cisco XDR. We went for Cisco XDR because we're all already trained in Cisco. Reliability is also a big reason. 

I would rate Cisco XDR a nine out of ten. The only thing that could make it a ten is better licensing. That's my only complaint.

I use Cisco XDR because I'm a SOC analyst. It's something I use every single day. The majority of my work has been in Cisco XDR looking through incidents, reading reports that it gives, and making automations. 

I use Cisco XDR as more of an integration tool for all of our Cisco tools. I work in a Cisco Suite. We have AMP, Umbrella, Firepower, and all these different tools connected to Cisco XDR, and I can get all my data in one place. It's easier to look at just one tool versus the eight to ten other tools that we have to get data. It saves time and puts us ahead of different threats since it's all in one spot.

I saw the benefits of Cisco XDR immediately after the tool came out. We had meetings with Cisco where they were telling us about the tool. The higher-ups that I work for saw a need for it first, and then they came to the SOC group. When we sat in on the first meeting, we immediately knew that this was a tool we needed to help us save time and get ahead.

One of my favorite features of Cisco XDR is the automation tool, which saves a lot of time because we can craft these automations and workflows. If we get a phishing email, I can set up a workflow that can be initiated the minute the email comes in. If it suspects that to be malicious, it goes ahead and quarantines the file so that it can't spread through our network.

An issue that we have with Cisco XDR is the observable list. These observables are basically similar to a chess board where you have a certain number of spots to put pieces. It's the same concept when we're doing investigations. We're only allowed 2,000 characters and up to 1,000 observables when we do investigations. If we have a list of domains we need to block, such as 4,000 domains, I can only block 100 domains at a time because if I put in more than 100 domains, I hit that 2,000 character max and can't continue with an investigation. Being able to put in all 4,000 domains, without a character limit or observable limit, would make doing those case books a whole lot easier and blocking those domains a whole lot easier too.

I have been using Cisco XDR for about a year and a half.

When we first started with Cisco XDR in August, everybody was having issues. There were three people in our organization, including me, who couldn't even log in to Cisco XDR. We were constantly in meetings and contacting them by sending network logs or through calls. They were remotely looking at our screens. 

For about three months, our machines would freeze, and it wasn't just Cisco XDR. It was also integrated with AMP, and both sides would just freeze and lock up. We couldn't do anything, and even when we deleted the tabs, it would just crash out. That lasted for about three months, but once they got it fixed and figured out the issue with the observables and with the character limit, it's been flawless.

I have contacted the technical support for Cisco XDR. They answered pretty quickly, and they were always willing to get into a meeting with us. I didn't really have any issues with them besides minor things where they would tell me to do something that I had already tried or done. Other than that, they responded quickly, they were always willing to meet, and they were always willing to work as per my schedule.

Positive

Deployment went fine, but when it came to integration with tools, I was definitely the test guinea pig in terms of system failures. For two months, my Cisco XDR did not work because I was the one who found the observable issue and reported it to Cisco. There were multiple meetings and constant back and forth with engineers, telling them the things they were telling me to do were not working. They were not able to understand that I could not even log in to the application without it freezing. So, the deployment went well, but for the next two months, we had issues, which is normal with a new tool. We got it as soon as it hit the market, so we knew that there were going to be some complications.

I wouldn't say we have it fully set up right now. We're still integrating tools and workflows into it. We have it in working condition where we're able to do investigations in it, so we have it 95% set up now.

I'd rate Cisco XDR a nine out of ten overall.