Category Archives: Cybersecurity

Alert correlation is one of the central promises of a modern SOC platform: turn many low-level signals into a smaller number of investigations that represent meaningful activity. Cortex XSIAM supports that goal in more than one way. It can stitch related alerts through platform context such as causality, and it can also run explicit correlation […]

Threat hunting in Cortex XDR is not the act of running broad queries until something looks unusual. It is a disciplined process for testing a security hypothesis against endpoint and related telemetry, validating what the results mean, and deciding whether the finding should expand into an incident, a new detection, or no action at all. […]

Zero trust is often summarized as “never trust, always verify,” but verification has little value unless the result changes what the system allows. Policy enforcement is the mechanism that turns identity, device posture, resource sensitivity, session context, and threat signals into an actual decision at the point where a subject tries to reach a resource. […]

Cortex XSOAR becomes valuable when it can reliably exchange data and actions with the tools around the SOC. That makes integration design a core architecture problem rather than a setup task. An integration that works in a test command can still fail in production because credentials rotate, an API rate limit is reached, the remote […]

Cloud security changes when an application starts running. Build-time scanning can identify vulnerable packages and configuration issues, but runtime introduces processes, network connections, credentials, workload identities, user actions, and behavior that did not exist as static code. Cortex Cloud Runtime Security is designed for that active phase, adding detection and prevention around cloud workloads, containers, […]

FortiSASE Secure Internet Access (SIA) extends FortiOS-based security policy to remote users and sites through cloud-delivered firewall and secure web gateway services. Current FortiSASE 7.4 architecture supports agent-based remote users through FortiClient, agentless browser-based users through explicit proxy, and site-based users through FortiGate, FortiExtender, FortiAP, Branch On-Ramp, or related secure-edge patterns. SIA applies capabilities such […]

Cisco AnyConnect Secure Mobility Client 4.x is in end-of-life. Software maintenance ended March 31, 2024, while application software support for the 4.x product line continues only until March 31, 2027 under Cisco’s published lifecycle. Cisco’s current endpoint product is Cisco Secure Client 5.x, which was built from AnyConnect and consolidates VPN plus modules such as […]

Cisco Duo conditional access is built from layered Duo policies that evaluate the user, application, authentication method, network location, endpoint trust, device health, and risk signals before allowing access. Current Duo policy controls include Trusted Endpoints, Duo Desktop and device health checks, authorized networks, authentication methods, Risk-Based Factor Selection, Risk-Based Remembered Devices, operating-system/browser restrictions, and […]

Cisco Identity Services Engine profiling builds a contextual inventory of endpoints by collecting attributes from network traffic, RADIUS sessions, DHCP, HTTP, SNMP, DNS, NMAP, Active Directory, pxGrid, and other supported probes. Current Cisco ISE 3.5 adds profiling resiliency improvements and newer Multi-Factor Classification (MFC) policy options, while preserving the familiar certainty-factor and profiler-policy model. Profiling […]

Cisco Security Group Tags (SGTs) are 16-bit labels used by Cisco TrustSec to represent the security role of a user, device, or workload independently of IP subnet. ISE assigns or distributes SGTs, capable network devices carry those tags in the data plane or maintain IP-to-SGT bindings, and enforcement devices apply Security Group ACLs (SGACLs) according […]

Cisco XDR incidents are correlated groups of security detections assembled from Cisco and supported third-party sources. Current Cisco XDR documentation describes a real-time correlation engine that analyzes shared observables, overlapping timelines, related attack patterns, native detections, threat intelligence, network telemetry, endpoint events, identity signals, cloud alerts, and other integrated data to determine when several findings […]

IKEv2 troubleshooting is easiest when the tunnel is treated as a sequence of dependencies: IP reachability to the peer, IKE_SA negotiation, authentication, CHILD_SA/IPsec negotiation, route/crypto-domain selection, NAT exemption, access control, and finally packet counters in both directions. Cisco Secure Firewall and ASA use IKEv2 for site-to-site and remote-access VPNs, with current management platforms exposing VPN […]

Cisco TrustSec microsegmentation uses Security Group Tags (SGTs) and Security Group ACLs (SGACLs) to express access policy between roles instead of between subnets. Cisco ISE assigns SGTs to users, devices, and workloads through authentication/authorization or static mappings, distributes environment and policy data, and maintains the TrustSec matrix that defines which source group can communicate with […]

Cisco Secure Firewall decryption policies determine how TLS/SSL traffic is decrypted, bypassed, blocked, or evaluated before access-control and deeper inspection. Current Secure Firewall Management Center and Device Manager 7.7 documentation separates actions such as Decrypt – Re-sign for outbound client traffic, Decrypt – Known Key for inbound servers where the private key is available, Do […]

Current FortiDDoS-F documentation organizes DDoS mitigation around Service Protection Policies (SPPs), protected subnets, traffic learning, system-recommended thresholds, and per-layer mitigation behavior. The important design principle is that a DDoS policy should reflect the normal traffic profile of the service it protects. Factory defaults or emergency thresholds can keep a device running during setup, but current […]