Developing With Cisco XDR at Cisco Live San Diego ‘25

Cisco XDR has always been predicated on the knowledge that every customer and every SOC is different. With thousands of products on the market clamoring for attention and budgets, the likelihood of any XDR solution supporting all your organization’s needs is minimal.

For these reasons, Cisco XDR is built on top of a foundationally open architecture with documented open-source protocols and RESTful APIs. If a technology your team relies on isn’t supported out-of-the-box in Cisco XDR, that can be addressed by the vendor of that product, or even yourself.

If software development was easy, everyone would do it. This is why we are taking steps to lower the barriers to entry for custom integrations, and we’re announcing some important developments at Cisco Live in San Diego in June. These changes will make it easier to not only write custom content, but to also find and share content written by the Cisco XDR community.

This year, we’re excited to host DEVNET-2236, DEVNET-2387, and the DevNet Innovation Zone demo booth, where we’ll showcase groundbreaking updates for Cisco XDR. Don’t miss out on the opportunity to learn, connect, and collaborate with our team and the broader DevNet community.

Cisco XDR integrations can offer several different outcomes depending on what the technology does and how you want to use it. A security product, or even networking, collaboration, productivity, and other products, can be leveraged from within XDR to do all this and more:

• Provide its security event data into the incident generation and analysis pipeline
• Participate in threat hunting and investigation tasks in XDR by providing event data and/or threat intelligence
• Display metrics, statistics, and other operational data in XDR’s shared dashboard, such as blocking malicious sessions or files
• Communicate and track investigation and response activity

Start your Cisco Live San Diego experience with a deep dive into the latest advancements in Cisco XDR. Whether you’re a DevNet enthusiast, a security professional, or someone passionate about innovation: this is your chance to see how Cisco XDR is taking incident response, automation, and community collaboration to the next level. Continue reading for the details!

What to Expect From Session DEVNET-2236

When: Monday, June 9th, at 3:00 PM
Where: DevNet Theater

In this session, we’ll explore how you can unlock the full potential of Cisco XDR with custom integrations and automation. Here’s a glimpse of what you’ll learn:

• Custom Integrations: Discover how to use almost any product to gain the outcomes described above, as applicable. New features in XDR have opened new pathways to participation in the Incident generation and correlation pipeline, and we are excited to share more info about these.
• Custom Workflows for Automation: Tune your incident investigation and response processes to match your unique security needs.
• Open Cybersecurity Schema Framework (OCSF): Be the first to see how you can bring your own data into XDR’s data warehouse using this open standard (OCSF v1.4). We are announcing some exciting features around this, and we will show you a sneak peek!
• Community Features and XDR Content Explorer: Learn how to collaborate seamlessly with the DevNet community to share and innovate around XDR integrations.

This session is designed to inspire and empower you to take your security operations to the next level. Whether you’re just getting started with XDR or are already an advanced user, this session has something for everyone. Everything that we will demo will be made available as soon as possible after the session.

For those that stay until the end of the DevNet session, there will be a gift at the end: you will receive a coupon for a free expert feedback session on your first OCSF workflow!

Sign Up for DEVNET-2236 today! Spots are limited, so secure your seat now.

What to Expect From Session DEVNET-2387

When: Monday, June 9th, at 2:00 PM
Where: DevNet Theater

Join us for an exciting session on an AI-assisted automation project in Cisco XDR, that’s designed to uplevel Security Analyst efficiency. This project bridges the gap between manual “quick lookup” tools and automated intelligence, empowering you to streamline investigations and customize workflows to your team’s needs.

This is what you will learn in the session:

• How to improve the day of a Security Analyst by automating access to common investigative resources, like IP geolocation, domain ownership, or MAC address vendor details
• How to use a customizable, open XDR framework tool to pivot to external resources and fetch desired data directly into the XDR UI
• How to save time with an AI agent that not only retrieves data but also generates summaries and performs meta-analysis using LLMs to identify patterns, anomalies, and red flags across incident observables

This session is an “art of the possible” demonstration, complete with GitHub links to help you explore and implement these exciting capabilities in your own environment.

Visit Us at the DevNet Innovation Zone Demo Booth

When: Monday, June 9th, from 9:00 AM to 5:00 PM
Where: DevNet Innovation Zone

Before or after the session, make sure to stop by the DevNet Innovation Zone demo booth to:

• See Cisco XDR’s new features live in action
• Ask questions and get hands-on insights from our experts
• Explore how custom workflows, integrations, and community features can transform your security operations

This is your chance to interact directly with the team behind Cisco XDR and get personalized guidance on how to make the most of these exciting updates.

Closing Off the Day in Style

As the day comes to an end, join us for drinks and networking at the demo booth starting at 5:00 PM. This is a great opportunity to:

• Share your feedback on what you’ve seen and learned
• Connect with like-minded professionals and the DevNet community
• Celebrate the spirit of innovation and collaboration that defines Cisco Live!

Let’s close the day on a high note together. See you there!

We’d love to hear what you think. Ask a question and stay connected with Cisco Security on social media!

Cisco Security Social Channels

LinkedIn
Facebook
Instagram
X

Share: