XDR User Guide
The Cisco XDR integration is currently in beta. XDR device insights integration with Meraki Systems Manager and L3 firewall rule automation with Meraki MX is coming soon.
Meraki and XDR Integration
The following sections will help you to manage the Meraki and XDR integration on the Meraki dashboard:
Enable XDR Integration
- Navigate to Organization > Configure > Integrations page in the Meraki dashboard.
- Click on Connect in the XDR tile.
- Select your XDR region and click Continue to go to the XDR sign-in page.
- After signing into XDR, you will be redirected to the Organization > Configure > Integrations page.
- If this is your first time configuring this feature you can click Configure Networks popup at the top of the Integrations page. This will allow you to configure which networks should send flow telemetry to XDR. See the Configure Networks section below for details on configuring networks.
- Select the checkbox next to the network(s) you want to configure. After selecting the networks, you can proceed by clicking Enable.
- After clicking Enable, a confirmation window will appear for the networks that will have changes. Click Enable to proceed.
- To view information about the XDR integration after it has been enabled, go to Organization > Configure > Integrations and click on the My Integrations tab.
- Click on the XDR integration for organization to view details on the connected account.
Configure your Network
- To configure a network, navigate to Organization > Configure > Integrations page in the dashboard and click on the My integrations tab.
- Click on the XDR Integration.
- Click Configure Networks which can be found in the Use this Integration section.
- Select the checkbox next to the network(s) you want to configure. After selecting the networks, you can proceed by clicking Enable.
- After clicking Enable, a confirmation window will appear for the networks with changes. Click Enable to proceed.
- Configuration is complete. To view XDR Incidents in the Meraki dashboard, navigate to Organization > Monitor > Security Center and click the XDR Incidents tab. Refer to the View and Manage XDR Incidents section for more details.
Disable XDR Integration
Disconnecting the XDR integration will stop all MX devices from sending flow telemetry to your XDR tenant. It does not delete the telemetry or incidents in XDR.
- Go to Organization > Configure > Integrations page in the dashboard and click on My integrations tab to disable the XDR integration.
- Click on the XDR integration you want to disable.
- Click Remove in the top right corner of the page.
- In the dialog box that opens, confirm your action by typing "Remove" in the textbox and then click the Remove button.
- Once removed, there will be a confirmation in dashboard and the integration will be removed from the integration list.
View and Manage XDR Incidents
Once the integration steps are completed, your XDR tenant will be connected to the Meraki dashboard. To view and manage XDR Incidents, go to Organization > Monitor > Security Center page in the dashboard.
On the Security Center page, you will see a new tab called XDR Incidents. Click the tab to see the XDR Incidents that are in your tenant. By default, the last 30 days will be shown. You may change the timeframe to view incidents older than or more recent than 30 days.
For a comprehensive overview of an incident, simply select the desired incident from the table. Doing so will open a sidebar containing further details. To delve deeper and explore the incident within XDR, press the View in XDR button provided.
Assign User to Incident
To allocate an incident to a specific user, simply click the Unassigned label to trigger a sidebar displaying a list of potential Assignees.
Note: Only XDR users can be selected for the assignment.
Any changes to user assignment will be reflected in XDR. For more information on incident assignment, refer to Cisco XDR's Incident Documentation.
Change Incident Status
To change the status of an incident, click on the status drop-down menu for a list of available options. Any changes to the incident status will be reflected in XDR. For more information on incident status, refer to Cisco XDR's Incident Documentation.
