Chapter 5, ECSS
*Advantage Tier:
	Duo, 2x secure
*Essentials Tier:
	XDR Essentials, Endpoint Adv., Email Threat
*Dashboards:
		Secure Network, Threat defense
*User Protection Suite:
	Secure Access, DUO, ISE
*OOTB
*Top Targets
*Secure workload
*You are using Cisco XDR and Splunk for TDIR in your environment. You have opened the XDR dashboard in the Cisco Security Cloud app in Splunk to analyze XDR events. You would like to cross-launch to the Cisco XDR user interface to inspect a specific incident. How can you accomplish this goal?
	Incident Link
*MITRE Answer
*Your company uses Cisco XDR and Splunk in the SOC; both are integrated and used for efficient TDIR...
	Cisco Security Cloud App
*You have integrated Cisco XDR and Splunk in your environment for efficient breach protection. You started analyzing...
	Answer with "Ribbon"
*XDR Cohesity...
	Answer with "Snapshot"
*LOTL
*Answer with "svchost.exe"