[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-245928-105":53,"doc-detail-245928-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","incident-response-with-cisco-xdr-using-guided-and-automated-response","Incident Response with Cisco XDR - Using Guided and Automated Response","","Incident Response with Cisco XDR explores how a SOC can strengthen incident handling through Guided and Automated Response. The session sets expectations for practical, reference-based learning rather than an introductory overview, and includes moderated Webex Q&A for audience interaction. It walks through a phishing-driven scenario with clear roles for attacker, defender, and target, then structures response actions across identification, containment, eradication, and recovery while previewing the roadmap.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/incident-response-with-cisco-xdr-using-guided-and-automated-response/245928/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/incident-response-with-cisco-xdr-using-guided-and-automated-response/245928.png","ImageObject",442,249,{"name":88,"@type":89},"Berry Peter","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-09-12",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",8,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What is the main goal of this session on Cisco XDR?","Question",{"text":109,"@type":110},"To show how to level up a SOC using both Guided and Automated Response for incident handling.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What incident response phases are covered?",{"text":114,"@type":110},"Identification, containment, eradication, and recovery.",{"name":116,"@type":107,"acceptedAnswer":117},"How can attendees ask questions during the session?",{"text":118,"@type":110},"Use the Webex app to chat with the speaker in the moderated Webex space.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},245928,1791732329,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":32},1374402524268,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Incident Response with Cisco XDR  \nHow to level up your SOC using both Guided and Automated Response  \nChristopher van der Made – PM Leader, Cisco XDR  \nSander Zumbrink – Security Consultant & Developer, HOB ICTBRKSEC-2502  \n-  \nBreach Protection Learning Map  \nYOU ARE HERE!  \nBRKSEC-2502 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 2  \n-  \nWebex App  \nQuestions?  \nUse the Webex app to chat with the speaker after the session  \nHow  \n1 Find this session in the Cisco Events mobile app  \n2 Click “Join the Discussion”  \n3 Install the Webex app or go directly to the Webex space  \n4 Enter messages/questions in the Webex space  \nWebex spaces will be moderated  \nby the speaker until February 28, 2025.  \n-  \nBRKSEC-2502 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 3  \nSetting expectations…  \nNot an intro to Cisco XDR  \nReference slides  \nHidden slidesin PDF  \nSubject to changes  \n-  \nPlease ask questions!  \nWebex Q&A  \nWorkflows available  \nBRKSEC-2502 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 4  \n-  \nCHRIVAND$ whoami  \n> Background: Dutch/American, Rotterdam (NL)  \n> Education: MSc in Information Science (Neuroscience & Computer Science)  \n> Cisco Journey:  \n> Associate Systems Engineer (2015)  \n> Consulting Systems Engineer, Security (2016-20)  \n> Developer Advocate, Cisco DevNet (2020-22)  \n> Engineering PM, SecureX (2022-24)  \n> Engineering PM Leader, Cisco XDR (2023-now)> Hobbies: building stuff  \n-  \nSander-Zumbrink$ whoami  \n> Function: Security Consultant & Developer  \n> Company:  \n> HOB ICT Security ([www.hob-it.nl](www.hob-it.nl))> Cisco partner – Focus Security  \n> Managed Secure  \nDNS/Web/E-mail/Endpoint/XDR  \n> Hobbies: BBQ + Lifeguard  \nAgenda  \n• Under attack, now what?  \n• What tools do we have in our belt (Cisco XDR) today?  \n• Responding to the Incident:  \n• Part 1: Identification  \n• Part 2: Containment  \n• Part 3: Eradication  \n• Part 4: Recovery  \n• Closing with sneak peak into Roadmap  \n© 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public  \nAgenda  \n• Under attack, now what?  \n• What tools do we have in our belt (Cisco XDR) today?  \n• Responding to the Incident:  \n• Part 1: Identification  \n• Part 2: Containment  \n• Part 3: Eradication  \n• Part 4: Recovery  \n• Closing with sneak peak into Roadmap  \n© 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public  \nUnder attack, now what?  \n-  \nThe Phishing Scenario: “Hobbits Demo”  \nAttacker: Sauron, the professional Phisher  \nDefender: Gandalf, the Incident Responder  \nTarget: Frodo, the Account Manager  \nBRKSEC-2502 © 2025 Cisco and/or its affiliates. All rights reserved. Cisco Public 10  \n-","cbCaiiNj2D0vXUgp","https://ap.wps.com/l/cbCaiiNj2D0vXUgp","pdf",14686275,143,"English","# How to level up your SOC with Guided and Automated Response\n## Session access and Webex Q&A\n## Agenda and incident response framework\n## Phishing scenario: Hobbits Demo\n## Responding to the incident\n## Closing roadmap sneak peek","[{\"question\":\"What is the main goal of this session on Cisco XDR?\",\"answer\":\"To show how to level up a SOC using both Guided and Automated Response for incident handling.\"},{\"question\":\"What incident response phases are covered?\",\"answer\":\"Identification, containment, eradication, and recovery.\"},{\"question\":\"How can attendees ask questions during the session?\",\"answer\":\"Use the Webex app to chat with the speaker in the moderated Webex space.\"}]","Incident Response with Cisco XDR - Using Guided and Automated Response | PDF",1789232154]