Organizations

The Organizations page in the Administration group provides information about the current Orbital organization, allows you to enable or disable the Script feature, and configure your Linked Organizations.

Only administrators can link organizations and view linked organizations.

Orbital Organizations and Device Organizations

Orbital uses two types of organizations:

  • Orbital organization – The organization whose users access the Orbital console and initiate queries and scripts.

  • Device organization – The organization that contains the devices and Orbital nodes targeted by queries and scripts.

Multiple Orbital organizations can be linked to the same device organization and target the same devices. However, query, script, and System Snapshot results are only visible to users within the Orbital organization that initiated them. Users from other Orbital organizations linked to the same device organization cannot see each other's results. For setup instructions, refer to the Link Organization section below.

Organization name

The Organization name field displays the name that your organization registered with Secure Endpoint.

Organization ID

The Organization ID field displays the ID number assigned by Orbital to your organization.

Organization features

Orbital Script feature allows you to use Python to counteract threats found through queries on one or more of an organization's devices.

Enable Script Feature

To enable Script feature:

  1. Click the Script toggle switch.

  2. When the Script enabling disclaimer appears, click Enable.

After you enable the Script feature, nodes may need up to 10 minutes to update their configuration to be able to run Scripts on that device (nodes require internet connectivity).

Disable Script Feature

To disable Script feature:

  1. Click the Script toggle switch.

  2. When the Script disabling disclaimer appears, click Disable.

To learn more on how to use Script, refer to the Using Scripts topic.

Only an administrator can enable or disable the Script feature. Additionally, once the Script is enabled, it will be available across all linked organizations.

Node configuration

The Node configuration section allows administrators to configure osquery file event collection settings for all Orbital nodes in the organization.

These settings apply only to Linux and macOS nodes.

To update a node's settings, click the Edit icon or select its checkbox. The Edit Node Configuration window opens.

Collect file events

The Collect file events toggle enables or disables file event collection on Orbital nodes. It is enabled by default.

Maximum buffered file events

The Maximum buffered file events field determines the maximum number of file events osquery buffers per node. The default value is 50,000. The system will automatically remove the oldest events if that limit is reached, creating space for new data.

  • Increase this value to prevent dropped events during high file activity.

  • Decrease this value to lower memory usage on nodes.

If you set this value too high, you may overload node memory and storage.

Event expiration

The Event expiration field sets the age threshold after which file events become eligible to expire. The default value is 3,600 seconds (one hour).

Use the drop-down menu to set the time unit (seconds, minutes, hours, or days). Note that the table may display your value in a different unit to improve readability.

Events expire only when the table is queried. Until then, events accumulate in the backing store or are dropped when the Maximum buffered file events limit is reached. Lowering this value will not free storage on nodes that are not being queried.

Automatically restore defaults

The Automatically restore defaults field lets you schedule a revert to default configuration values after a set duration (up to one year). This prevents temporary changes from staying in effect indefinitely.

The date and time picker uses your local device settings. Note that the scheduled restore time in the table will display in your account’s preferred timezone (configured under Administration > My Account).

Click Save to apply your changes. You will see a confirmation message, and updates should sync to Orbital nodes within 10 minutes.

Link Organization

This allows you to link any appropriate Secure Endpoint defined organization or organizations to the organization you have defined in Orbital.

The process to link organizations is different for Cisco XDR and Cisco Secure Endpoint customers.

Cisco XDR Customers (not Cisco Secure Endpoint customers)

Cisco XDR and Orbital are inherently linked; no action is required to link your organizations.

Cisco Secure Endpoint Customers (not Cisco XDR customers)

In the Secure Endpoint console, click the Connect Cisco XDR or Cisco Secure Client Cloud Management banner.

Cisco Secure Endpoint & Cisco XDR Customers (who own both products)

  1. Click Set up modules. This will take you to the Cisco XDR Integrations page.

  2. Once you have set up your Secure Endpoint integration with Cisco XDR, return to Orbital Organizations page. The Cisco XDR organizations associated with the chosen integration will appear in the Link Organizations table.

  3. Navigate to the organization's table listing you want to link.

  4. Click Link organization.

  5. When the Organization Link Confirmation pop-up appears, click Link.

You can only link to Secure Endpoint integrations.

When a Secure Endpoint organization is connected to an Orbital organization, that connection is available to all users in the Orbital organization.

If you access Orbital before you have set up a module in Cisco XDR, the Link organization button and associated table will not be displayed. Only the Set up modules button will be displayed.

Page Refresh Display

This element is used to display the last date that the Link organization listing was refreshed.

This element consists of:

  • Refresh - This component is used to refresh the listing of the Link organization.

  • Created - This component is primarily used to display the date and time that the Linked Organizations list was created. It allows you to:

    • Copy the date and time of last Linked Organization list refresh in ISO-8601 format.

    • Copy the date and time of last Linked Organization list refresh in UNIX time format.

    • Change the default time preferences for your account. Clicking the Change time preferences... will take you to the My Account page of the Administration group. Refer to the My Account topic for more information on setting your account's default Time Options.

The Link Organization element comprises these columns:

Status

This column shows if the organization in the current row is linked to the current Orbital organization.

If the Secure Endpoint organization is linked to the current Orbital organization, the word Linked will appear in this column.

If the Secure Endpoint organization is not linked to the current Orbital organization, the Link organization button will be displayed.

Clicking Link will link the displayed Secure Endpoint organization to the current Orbital organization.

Device organization name

This column lists the name of the organization that the devices belong to.

Product

This column lists the name of the Cisco product that the listed organization is registered through. In the case of Orbital, these will all be Secure Endpoint.

Created

The column lists the date and time that the link to the organization was created.

Linked By

This column displays the name of the user that linked the Secure Endpoint organization to the current Orbital organization.

If the current organization has been linked during system setup, the value Automatically Linked will be displayed in the column.

Device organization ID

This column lists the identification number of the organization that is being linked to by the current user for the current Orbital organization.

More Info