Who does what
Provider
- Investigate supported XDR incidents
- Execute permitted containment
- Report findings and recommendations
Your team
- Maintain components and access
- Approve response permissions
- Complete remediation and recovery
Coverage
- Endpoints
- Identity & Access
- Network
Details
Service scope
Best for Teams choosing Cisco XDR as their managed detection and response platform
A managed XDR tier
Premier adds Cisco analysts to Cisco XDR over supported components.
Permission by action
Authorize Cisco per incident or by action type. Reserved actions remain with your team.
Incident-response hours
Talos IR and assessment work consumes the purchased service-hours balance.
Full service analysis
Cisco XDR Premier analysts investigate supported components around the clock and execute approved containment through Cisco XDR. Your team maintains those components, defines response permissions and completes remediation and recovery.
- Your team owns
- Maintain component licenses, configuration and API access
- Approve the response playbook and reserved actions
- Perform remediation, diagnostics and recovery beyond approved containment
A managed XDR tier
Premier adds Cisco-operated monitoring and investigation to Cisco XDR. Supported third-party products can contribute, but the service still uses Cisco XDR as its operational platform.
Permission by action
The response playbook distinguishes actions Cisco may perform from actions reserved for the customer. Per-event approval and preapproval by action type are both possible. Other remediation remains buyer work.
Incident-response hours
Talos Incident Response and technical assessments draw on a service-hours balance determined by the purchase. These entitlements are distinct from routine 24/7 XDR operations and do not imply unlimited incident recovery.
Pricing & contract
- Billing
- Custom
Scope the Premier subscription, connected products, data allowances and service-hours balance together.
Tradeoffs & buying questions
Strengths
-
Response permissions can be agreed by event or action type
-
Supports eligible third-party products alongside Cisco tools
-
Combines recurring XDR operations with scoped specialist services
Considerations
-
Requires Cisco XDR and supported components
-
Buyers maintain credentials and underlying tools
-
Talos and assessment work depends on available hours
Ask before buying
- Which components and response actions are covered, and which need approval for every incident?
- What are the XDR, Premier service, ingestion, retention and third-party license charges?
- How many Talos IR or assessment hours are included, when do they expire, and who owns support through our reseller?
Integrations
Platform / SIEM
- Cisco XDR
Endpoint
- Cisco Secure Endpoint
Other integrations
- Cisco Umbrella
- Cisco Secure Malware Analytics
- Eligible third-party security tools
Common questions
Is Premier the same as buying Cisco XDR software?
No. Premier is the managed tier, adding Cisco security analysts and defined service responsibilities.
Does Cisco own every response action?
Cisco executes the identification and containment actions assigned to it in the response playbook. Your team retains the rest.