At the GovWare SOC, Cisco XDR served as the backbone of Tier-1 and Tier-2 threat detection and response. Acting as the central platform, it integrated seamlessly with Splunk, Endace, Secure Network Analytics (SNA), Secure Malware Analytics (SMA), Cisco Secure Firewall, Cisco Secure Access (CSA), and several third-party intelligence feeds. This powerful combination provided real-time visibility, rapid event correlation, and automated analysis, helping significantly reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
Across the entire operation, Cisco XDR detected 39 security incidents. Out of these, 12 were directly relevant to GovWare’s security environment, while the remaining 27 were low-risk occurrences that required no immediate action. In total, 30.7% of all detected incidents were confirmed threats. Each case was carefully analyzed by the SOC team, and the more critical events were escalated to the GovWare NOC for follow-up.
A deeper review revealed that incidents were triggered by multiple integrated data sources—Network, SNA, Secure Firewall, Endace, Secure Access, and Splunk. Through XDR’s correlation engine, the SOC team was able to categorize the threats into common attack types, including:
- Malicious port scanning
- Malicious domain access
- Suspicious Internet IP access
- Clear-text password transmission
- Email vulnerability exploitation
- Possible data loss events
Below are two representative case studies that highlight how Cisco XDR enabled fast and accurate investigations.
Case Study 1: Identifying Unencrypted Transmission of Sensitive Files
How the Investigation Unfolded
1. Network Visibility Through Endace
Endace captured SPAN traffic and generated both packet captures and Zeek logs. The logs were forwarded to Splunk, while extracted files were sent to Cisco Secure Malware Analytics (SMA) via Splunk Attack Analyzer fully integrated with Cisco XDR.
2. Automatic Incident Trigger in XDR
Cisco XDR continuously monitored SMA alerts. When a sensitive file was detected travelling over an unencrypted protocol, XDR automatically created an incident and sent it to analysts.
3. Searching Logs in Splunk
Using SPL queries, analysts matched the file’s UID across the logs and uncovered the actual source IP responsible for the transmission.
4. Deep Packet Inspection via Endace
Analysts filtered traffic by source and destination IPs, located the original session, and reviewed packet-level details in Wireshark to confirm the incident.
5. Conclusion & Mitigation
The investigation revealed sensitive business files were transmitted without encryption. The full details source IP, destination IP, URL, file name, and protocol were reported to the GovWare team. Attendees were reminded to avoid unencrypted transfer methods to prevent data leakage.
Case Study 2: Tracking Down Malicious Port Scans on the Internet Gateway
How the Investigation Unfolded
1. Telemetry via CTB, SNA, and XDR Analytics
Cisco Telemetry Broker converted SPAN traffic into NetFlow, forwarding it to SNA and XDR Analytics. Meanwhile, the firewall provided log and connection data to XDR.
SNA flagged port scan behavior, while XDR Analytics generated an “Internal Port Scanner” alert.
2. Correlation in Cisco XDR
XDR stitched alerts from SNA and XDR Analytics into a single incident. Despite an initially low priority, the correlation accuracy showed it was a genuine threat.
3. SNA Host Posture Review
Within Secure Network Analytics, analysts viewed the affected host’s behavior, asset group, and connections confirming unauthorized port scanning.
4. XDR Analytics Findings
Multiple internal IP addresses were seen scanning the same Internet Gateway address. Even without receiving responses, the IPs continuously probed new ports, a clear sign of malicious intent.
5. Conclusion & Mitigation
The Cisco Secure Firewall successfully blocked all attempts, but the behavior was still reported to the GovWare NOC due to potential network impact.
Other Noteworthy Findings
Beyond the major investigations, XDR also detected:
- Clear-text password transmission
- Malicious domain connections
- Attempts to access risky Internet IP addresses
These were escalated to the Tier-3 team for deeper investigation and reporting.
Final Thoughts
Cisco XDR proved essential to the GovWare SOC, empowering analysts with real-time detection, powerful correlation, automated workflows, and seamless integrations with Splunk, Endace, Secure Firewall, Secure Access, and Talos.
From triaging alerts to mapping the attack chain, analysts could quickly update incident statuses, document findings, and collaborate with relevant teams. Throughout operations, Cisco XDR significantly enhanced detection speed, investigation quality, and overall response efficiency helping ensure the GovWare conference remained secure.
