📘Cisco DevNet Associate (200-901 DEVASC)
Cisco provides several security platforms to help organizations protect their networks, endpoints, users, and data. Each platform has a specific purpose, and many of them can integrate via APIs for automation and reporting.
We’ll cover:
- Cisco XDR
- Cisco Firepower
- Cisco Umbrella
- Cisco Secure Endpoint
- Cisco Identity Services Engine (ISE)
- Cisco Secure Malware Analytics (formerly Threat Grid)
1. Cisco XDR (Extended Detection and Response)
Purpose:
Cisco XDR is a threat detection and response platform that collects data from multiple sources (network, endpoints, cloud apps) and uses AI/analytics to detect, investigate, and respond to threats.
Key Capabilities:
- Collects security data from multiple sources: endpoints, network devices, cloud apps.
- Correlates alerts to detect complex threats.
- Automates threat response (e.g., isolate a compromised device on the network).
- Provides a single dashboard for security monitoring.
IT Example:
In a corporate environment, if an employee’s laptop shows unusual login activity and a network firewall detects abnormal traffic, XDR combines both events to flag a potential breach.
API Usage:
- Automate alert retrieval for incident tracking.
- Integrate XDR with SIEM (Security Information and Event Management) systems.
- Trigger automatic responses based on security alerts.
2. Cisco Firepower (Next-Generation Firewall)
Purpose:
Cisco Firepower is a next-generation firewall (NGFW) that provides network security with advanced features.
Key Capabilities:
- Layer 7 application visibility (know which apps are running on the network).
- Intrusion prevention system (IPS) to block attacks.
- URL filtering and malware defense.
- VPN support for secure remote access.
IT Example:
A company blocks employees from accessing risky websites and prevents malware from entering the network using Firepower’s firewall policies.
API Usage:
- Automate firewall rule changes.
- Retrieve security event logs for analysis.
- Integrate Firepower with other security tools to trigger automated responses.
3. Cisco Umbrella (Cloud Security / Secure Internet Gateway)
Purpose:
Cisco Umbrella is a cloud-based security platform that protects users from internet threats, even outside the corporate network.
Key Capabilities:
- DNS-layer security: blocks access to malicious domains.
- Secure web gateway: filters web traffic and enforces policies.
- Cloud-delivered firewall and threat intelligence.
- Protection for remote users and cloud apps.
IT Example:
When a remote employee tries to visit a phishing website, Umbrella blocks the request before any malware can enter the device.
API Usage:
- Pull reports of blocked domains or user activity.
- Automate user onboarding or policy updates.
- Integrate with SIEM tools for incident analysis.
4. Cisco Secure Endpoint (Formerly AMP for Endpoints)
Purpose:
Cisco Secure Endpoint protects individual devices (laptops, servers, mobile devices) from malware and advanced threats.
Key Capabilities:
- Malware detection and prevention.
- Threat investigation and remediation.
- Behavioral analytics to detect suspicious activity.
- Retrospective security: identifies threats after they have occurred.
IT Example:
If a malicious file is downloaded on a company laptop, Secure Endpoint detects it, quarantines it, and reports it to the security team.
API Usage:
- Automate endpoint scans or policy enforcement.
- Retrieve threat reports for analysis.
- Integrate with XDR for automated response actions.
5. Cisco Identity Services Engine (ISE)
Purpose:
Cisco ISE provides network access control (NAC), which ensures only authorized users and devices can access the network.
Key Capabilities:
- User and device authentication (e.g., via 802.1X or certificates).
- Policy-based access control (who can access what network resources).
- Guest network access and BYOD (Bring Your Own Device) management.
- Profiling devices to apply appropriate security policies.
IT Example:
A new employee tries to connect a personal laptop to the corporate Wi-Fi. ISE checks if the device is compliant and grants access only to certain network segments.
API Usage:
- Automate user onboarding/offboarding.
- Pull reports on device compliance.
- Integrate with security platforms to enforce dynamic network policies.
6. Cisco Secure Malware Analytics (SMA / Formerly Threat Grid)
Purpose:
Cisco SMA analyzes malware in a controlled environment to understand its behavior and generate intelligence.
Key Capabilities:
- Sandboxing: executes suspicious files in an isolated environment.
- Detailed behavioral analysis of malware.
- Integration with security platforms for automatic threat blocking.
- Threat intelligence feeds for proactive security.
IT Example:
An unknown attachment in an email is analyzed in SMA to see if it tries to steal credentials or spread across the network. Once identified, a signature can be created to block it organization-wide.
API Usage:
- Submit files for automated analysis.
- Retrieve malware reports for integration with endpoint or XDR solutions.
- Feed intelligence into automated security workflows.
Summary Table for Exam
| Platform | Primary Function | Key Features | API Use Cases |
|---|---|---|---|
| XDR | Detect & respond to threats across multiple sources | Correlates alerts, automated response, dashboards | Retrieve alerts, trigger response, SIEM integration |
| Firepower | Network security / NGFW | IPS, URL filtering, malware blocking, VPN | Automate rules, get logs, integrate with security tools |
| Umbrella | Cloud security / Internet gateway | DNS security, web filtering, remote protection | Pull reports, automate policies, integrate with SIEM |
| Secure Endpoint | Endpoint protection | Malware detection, behavioral analytics, remediation | Automate scans, get threat data, integrate with XDR |
| ISE | Network access control | Authentication, policy enforcement, device profiling | Automate onboarding, compliance reporting, dynamic policies |
| Secure Malware Analytics | Malware sandboxing & analysis | Behavioral analysis, threat intelligence, sandboxing | Submit files, retrieve reports, feed threat intelligence |
Exam Tips:
- Focus on purpose + key features of each platform.
- Understand how APIs can automate security tasks (retrieving data, enforcing policies, integrating with other platforms).
- Know which platform handles network, endpoint, cloud, identity, or malware analysis—this is often tested.
- Remember that Cisco security platforms often work together via APIs for faster detection and automated responses.
