XDR User Guide

Enable XDR Integration

1. Navigate to Organization > Integrations page in the Meraki dashboard.
   
   
2. Click on "Connect" in the XDR tile.
    
3. Select your XDR region and click "Continue" to go to the XDR sign-in page.
   
   
4. After signing into XDR, you will be redirected to the Organization > Integrations page.
5. If this is your first time configuring this feature you can click “Configure Networks” popup at the top of the Integrations page. This will allow you to configure which networks should send flow telemetry to XDR. Please see the "Configure Networks" section below for details on configuring networks. 
   
   
6. Select the checkbox next to the network(s) you want to configure. After selecting the networks, you can proceed by clicking "Enable".
   
   
7. After clicking "Enable", a confirmation window will appear for the networks that will have changes. Click “Enable” to proceed.
   
   
8. To view information about the XDR integration after it has been enabled, go to Organization > Integrations and click on the “My Integrations” tab.
   
   
9. Click on the XDR integration for Organization to view details on the connected account
   

Configure your Network

1. To configure a network, navigate to Organization > Integrations page in the dashboard and click on the “My integrations” tab.
   
   
2. Click on the XDR Integration.
3. Click “Configure Networks” which can be found in the “Use this Integration” section.
4. Select the checkbox next to the network(s) you want to configure. After selecting the networks, you can proceed by clicking “Enable”.
   
   
5. After clicking “Enable”, a confirmation window will appear for the networks with changes. Click “Enable” to proceed.
   
   
6. Configuration is complete. To view XDR Incidents in the Meraki Dashboard, navigate to Organization > Security Center and then click on the “XDR Incidents” tab. Refer to the View and Manage XDR Incidents section for more details. 

Disable XDR Integration

1. Go to Organization > Integrations page in the dashboard and click on “My integrations” tab to disable the XDR integration.
2. Click on the XDR integration you want to disable.
   
   
3. Click "Remove" in the top right corner of the page.
   
    
4. In the dialog box that opens, confirm your action by typing “Remove” in the textbox and then click the “Remove” button.
   
   
5. Once removed, there will be a confirmation in dashboard and the integration will be removed from the integration list.
   
   

View and Manage XDR Incidents

Once the integration steps are completed, your XDR tenant will be connected to the Meraki dashboard. To view and manage XDR Incidents, go to Organization > Security Center page in the dashboard.

On the Security Center page, you will see a new tab called "XDR Incidents". Click the tab to see the XDR Incidents that are in your tenant. By default, the last 30 days will be shown. You may change the timeframe to view incidents older than or more recent than 30 days.

For a comprehensive overview of an incident, simply select the desired incident from the table. Doing so will open a sidebar containing further details. To delve deeper and explore the incident within XDR, press the 'View in XDR' button provided.