SecureX Ribbon

Cisco SecureX is both a centralized console and a distributed set of capabilities that unify visibility, enable automation, accelerate incident response workflows, and improve threat hunting. These distributed capabilities are presented in the form of applications (apps) and tools in the SecureX ribbon.

Use the ribbon to access the casebook, apps, settings, search observables for enrichment, view notifications, and view incidents.

Note: If you are an unactivated user in SecureX Demo, you must click Configure a Module to activate your SecureX account by enabling an integration module before you can access the ribbon.

Ribbon Views

By default, the SecureX ribbon is displayed as a bar in an expanded view or a floating button in a collapsed view. You can change the ribbon format (bar or button) in a collapsed view in the ribbon settings.

Expanded View

In an expanded view, the ribbon is located in the lower portion of the page, and it persists as you move between the SecureX pages in your environment. Click the - icon to collapse the ribbon.

When the ribbon is expanded, you can drag the container up and down or a double arrow up and down anywhere on the entire top side of the panel to resize the height of the panel.

SecureX Ribbon

Collapsed View

In a collapsed view, by default, the SecureX Ribbon floating button is located in the bottom right corner of the page, and it persists as you move between the SecureX pages in your environment. Hover over the SecureX Ribbon floating button to display the ribbon icons.

Ribbon Icons

You can customize the location and the behavior of the SecureX Ribbon floating button in the ribbon settings. Click the SecureX Ribbon floating button to expand the ribbon.

Ribbon Icons and Elements

The following icons and elements are displayed on the ribbon menu in an expanded view or when you hover over the SecureX Ribbon floating button in a collapsed view.

Home

Use the ribbon Home page to open the ribbon apps, Notifications Center, tips, and ribbon settings, launch integrated applications, and view your account profile which includes your user name, account email address, role, organization, and IDP used to log in.

Ribbon Home

As you move to other pages in the ribbon, click the Home Icon (Home) icon to return to the ribbon Home page.

Ribbon Tips

Click Ribbon Tips to open the Welcome to Ribbon page that lists all the quick and interactive tours for each of the main ribbon features.

  • Click Ribbon Basics and a tour guides you through an overview of the SecureX ribbon.

  • Click More Information to open the SecureX Ribbon Help topic in the SecureX Help to learn more about the features and apps.

Settings

Click Settings to open the SecureX ribbon, casebook, and notification settings. For information on the ribbon settings, see Configure Ribbon Settings.

Customize Applications Preview

A list of integrated applications are displayed in the Applications popup when you hover over the SecureX Ribbon floating button and click the (View applications list) icon or when you hover over the Home icon in an expanded ribbon menu.

To customize the list of applications in the Applications popup, click the (Customize Preview) icon next to Applications on the Home page and check the check boxes next to the applications you want displayed in the Applications popup.

Casebook App

Click the Casebook App Icon or (casebook app) icon in the ribbon menu or the Home icon in the SecureX Ribbon floating button menu to open the casebook app and save information about your threat analysis. You can also hover over the icon to view details about the current case.

Incidents App

Click the Incidents Icon or (incidents app) icon in the ribbon menu or the Home icon in the SecureX Ribbon floating button menu to open the incidents app and view incidents from the integrated products. You can also hover over the icon to view details about the incidents assigned to the current case and click Manage Incident to open the incident in SecureX Threat Response to view more information about the incident in the Incident Manager.

Orbital App

Click the Orbital Icon or (Orbital app) icon in the ribbon menu or the Home icon in the SecureX Ribbon floating button menu to open the Orbital app and perform additional queries.

Find Observables

Click the Find Observables Icon (Find Observables on Page) icon to search the current web page for malicious file hashes, suspicious domains and other cyber observables. You can then click Add Observables to Case or Investigate in Threat Response.

In the ribbon menu, enter search criteria in the Enrichment search box and press Enter to begin extracting observables. You can then click Add Observables to Case or Investigate in Threat Response.

See Search for Observables for more information.

Notifications

The Notifications Icon (Notifications) icon displays the number of new notifications. Click the icon to display the notifications of incidents that are assigned to you by other users in the Notifications popup. Once you click the icon, the new notifications are marked as read and the number of unread notifications resets.

Notifications

View Notification Details

Each notification includes the notification type, the date of the notification, an incident title link that opens the incident in the incidents app, and a source link that opens the source of the incident (if applicable). See Incidents App for more information on the incidents app.

Remove Notification

To remove a notification, hover over the notification and click the Clear icon. This also removes the notification from the Notifications Center.

Access Notifications Center

Click View All link to open the Notifications Center page and manage the notifications. See Notifications Center for more information.