Threat Intelligence Director (TID) is the primary component on Cisco Firepower that connects to Cisco SecureX. It acts as the conduit, pulling threat intelligence indicators from SecureX and applying them to the FTD’s inspection policies, enabling coordinated threat response across the security ecosystem.

The Internal Domains list within an Umbrella roaming client policy is specifically designed for this scenario. By listing domains (e.g., corp.local) and specifying the internal DNS servers that should handle queries for those domains, the client will bypass Umbrella and send those queries directly to the designated internal servers, ensuring resolution continues even if Umbrella is unreachable.

Cisco pxGrid is the common framework that allows products like Stealthwatch and ISE to share context and enable automated actions. Stealthwatch, acting as a pxGrid publisher, can send specific security events (like a host quarantine recommendation) to ISE, the pxGrid subscriber. ISE can then trigger a posture change, moving the host to a quarantined network segment.

This is a fundamental architectural difference. The Umbrella DNS Security module (often used with AnyConnect) typically only enforces DNS policy when the AnyConnect VPN is active. The Umbrella Roaming Security module is a standalone agent that provides continuous DNS-layer protection regardless of VPN connection status, making it ideal for always-on security for roaming endpoints.

The Duo Proxy (or Duo Authentication Proxy) is designed to integrate with existing RADIUS-based infrastructure. You configure your network devices to use RADIUS (AAA) for authentication, pointing them to the Duo Proxy server. The proxy then handles the communication back to Duo’s cloud service for MFA, providing a centralized, scalable, and secure method without needing agent software on the network devices themselves.

Outbreak control is a key differentiator for Cisco Secure Endpoint. Instead of waiting for the next scheduled signature update, it allows administrators to push an emergency, targeted detection rule directly from the cloud console to all connected endpoints. This provides immediate protection against a newly identified outbreak or zero-day threat across the entire deployment.

SecureX Orchestration workflows automate actions across different products by using their APIs. For a workflow to interact with Firepower and Secure Endpoint, SecureX must first be granted API access to these systems. This is done by providing API credentials (like a client ID and secret) with the necessary administrative scopes during the integration setup, allowing SecureX to authenticate and perform defined actions on behalf of the administrator.

Cisco ESA offers different log subscription tiers. The ‘Enhanced’ log subscription is specifically designed to include more granular details than the ‘Standard’ logs. This includes the names of the specific rules (like anti-spam or anti-virus rules) that matched and caused an action (e.g., quarantine, drop), which is crucial for troubleshooting and understanding why a message was handled a certain way.

The Cisco Security Graph is the foundational data model and storage system behind Cisco Threat Response. It ingests and normalizes disparate data from all integrated sources (enrichments, events, sightings) into a unified graph database. This allows CTR to perform powerful pivots and correlations, showing all relationships and activities tied to an observable across the entire security infrastructure.

Threat Intelligence Director (TID) is the primary component on Cisco Firepower that connects to Cisco SecureX. It acts as the conduit, pulling threat intelligence indicators from SecureX and applying them to the FTD’s inspection policies, enabling coordinated threat response across the security ecosystem.0