Privacy Data Sheet

Doc type
Cisco public

Cisco Cognitive IntelligenceThis Privacy Data Sheet describes the processing of personal data (or personally identifiable information) by Cisco CognitiveIntelligence.
Cisco Cognitive Intelligence is a cloud-based security solution made available by Cisco to companies or persons who acquire it
for use by their authorized users.
Cisco will process personal data from Cognitive Intelligence in a manner that is consistent with this Privacy Data Sheet. In
jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is the Data Controller for the personal dataprocessed to administer and manage the customer relationship. Cisco is the Data Processor for the personal data processed byCisco Cognitive Intelligence in order to provide its functionality.
Note: This Privacy Data Sheet is a supplement to the Cisco Online Privacy Statement.

1. Overview
Cisco Cognitive Intelligence is a cloud-based malware behavioral analysis solution for threat detection and analytics thatleverages (1) web proxy logs from a Cisco web gateway solution such as Cisco Secure Web Appliance, Cloud Web Security, orthird-party web proxies and (2) NetFlow from Cisco Secure Network Analytics and/or Cisco Secure Cloud Analytics (which may
include Enhanced NetFlow if the customer enables Cisco Encrypted Traffic Analytics) and (3) Event Log Data from Cisco Secure
Endpoint. The web proxy logs and/or NetFlow help identify malware present within a customer’s environment and allow acustomer to research related active malicious behaviors. Cognitive Intelligence is available via (a) Secure Endpoint, (b) Secure
Endpoint on Secure Web Appliance, (c) Secure Network Analytics and (d) Secure Cloud Analytics. Finally, Cognitive Intelligence’s
implementation of machine learning based on its Static File Analysis capability is also available to Secure Endpoint customers
via an integration with Cisco Secure Malware Analytics.
For more information about Cognitive Intelligence, visit https://www.cisco.com/c/en/us/products/security/cognitive-threatanalytics/index.html.
Cognitive Intelligence integrates with various Cisco products. Please see the applicable Privacy Data Sheet for details regarding
processing of personal data by the Cisco product receiving and/or sending personal data from/to Cognitive Intelligence.

2. Personal Data Processing
The table below lists the personal data processed by Cognitive Intelligence to provide its services and describes why the data
is processed.

Personal Data Category

Type of Personal Data

Purpose of Processing

Registration Information

••
••

•
•

NameAddress
Email address
Phone number©2022 Cisco and/or its affiliates. All rights reserved.

Account creation
Product enablement, product use notifications,training and support

Version 2.1, August 30, 2022

Privacy Data Sheet

Doc type
Cisco public
Web Log Usage and Event Data•••

Username1Device IP address
Destination IP address•••

Security analytics, forensics, and efficacy research
Product enablement
Global threat intelligence research

NetFlow Usage and Event Data•••••

Device IP address
Destination IP address
Device MAC address
Customer Group ID2
Customer TrustSec Security GroupTag ID and Name•••

Security analytics, forensics, and efficacy research
Product enablement
Global threat intelligence research

Firewall Event Data and Logs3

•
•
•
•
•
•
•

Username
IP address
Event type
File name
Accessed URLs
Device host name
Passive DNS logs•

Global threat intelligence research

Enhanced NetFlow Usage andEvent Data for Encrypted TrafficAnalytics (ETA) 4•

Any personal data contained in theInitial Data Packet (IDP)5•••

Security analytics, forensics, and efficacy research
Product enablement
Global threat intelligence research

Web and API Usage Log•

Identity of device used to upload
telemetry data (ex: serial numberor name designated by user)
Name of end user who accessedthe logs•••

Security analytics, forensics, and efficacy research
Product enablement
Global threat intelligence research•

Secure Endpoint Event Log andUsage Data•••••

Username
File nameFile path nameLocal URL, MAC address, IP address
Remote URL, MAC address, IPaddress•••

Security analytics, forensics, and efficacy research
Product enablement
Global threat intelligence research

Customer Submitted Files 6•

Any personal data that may becontained in a file submitted foranalysis••

Security analytics, forensics, and efficacy research
Product enablement

SPAD Reports7•••

Username
Computer nameIP address•Improve customer experience, configuration anddeployment support, assist with interpretation ofthreat detections, general product enablement, andintegration with other Cisco and third-party products

1Customer username collection is an opt-in feature that can be enabled through configuration settings.
Also known as Secure Network Analytics Host Groups; can be configured to capture internal traffic telemetry in addition to external traffictelemetry.
3
Only applies to customers using Cognitive Intelligence as part of a Secure Cloud Analytics subscription.
4
Enhanced NetFlow usage and event data is provided in addition to NetFlow usage and event data if generated by the underlying enterprisenetwork equipment.
5
IDP includes any data sent in the first packet of the communication, which may include sensitive data for unencrypted protocols (examplesinclude DNS traffic, plain-text HTTP URL, cookies, username, password, IP header, TLS header, Service Name Identifier, and Cipher suites.
6
Files are collected via Cognitive Intelligence’ “Static File Analysis” available via integration with Secure Endpoint and/or Secure Malware
Analytics.
7“SPAD Report” means the Simple Portal for Administration report created within the Cognitive Intelligence portal, which provides a preview of
the customer’s reports generated by Cognitive Intelligence. SPAD Report data is only processed if access is granted.
2©2022 Cisco and/or its affiliates. All rights reserved.

Version 2.1, August 30, 2022

Privacy Data Sheet

Doc type
Cisco public

3. Data Center Locations
Cognitive Intelligence leverages third party cloud hosting providers to provide services globally.
Infrastructure Provider

Description

LocationAWS US Cloud

Cloud infrastructure provider

United States – Virginia

AWS EU Cloud

Cloud infrastructure provider

IrelandEquinix

Cloud co-location facility for
Cisco Talos global threat intelligence

United States – Virginia

VazataCloud co-location facility for
Cisco Threat Intelligence Platform (TIP)

United States - Texas

Note: When you purchase a service subscription, Cisco always creates, processes, and stores your information in the UnitedStates regardless of the subsequent provisioning of your accounts in a chosen regional cloud: US, EU (Ireland), or Asia Pacific(Japan). All data are encrypted in transit.

4. Cross-Border Data Transfer Mechanisms
Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:••••Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses

5. Access Control
The table below lists the personal data used by Cognitive Intelligence to carry out the service, who can access that data, andwhy.
Personal Data Category

Who has AccessPurpose of the Access

Registration Information

Customer

Security administration and operations

Cisco

Account creation, license entitlement validation, and general productsupport and operations

WebLog Usage and Event
Data

Customer

Security administration and operations

Cisco

Security analytics, forensics, efficacy research, general productenablement, and global threat intelligence research

NetFlow Usage and Event
DataCustomer

Security administration and operations

Cisco

Security analytics, forensics, efficacy research, general productenablement, and global threat intelligence research

Firewall Event Data and Logs

Customer
Cisco

Security administration and operations
Global threat intelligence research©2022 Cisco and/or its affiliates. All rights reserved.

Version 2.1, August 30, 2022

Privacy Data Sheet

Doc type
Cisco public
Enhanced NetFlow Usage andEvent Data for Encrypted
Traffic Analytics (ETA)

Customer
Cisco

Security administration and operations
Security analytics, forensics, efficacy research, general productenablement, and global threat intelligence research

Web and API Usage Log

Cisco

Security analytics, forensics, efficacy research, general productenablement, and global threat intelligence research

Secure Endpoint Event Log
Usage and Event Data

Cisco

Security analytics, forensics, efficacy research, general productenablement, and global threat intelligence research

Customer Submitted Files

Cisco

Security analytics, forensics, efficacy research, general productenablement, and global threat intelligence research

SPAD Reports

Customer
Cisco

Security administration and operations
Improve customer experience, configuration and deployment support,
assist with interpretation of threat detections, general productenablement, and integration with other Cisco and third-party products

6. Data Portability
Data Portability Requirements are not applicable to this product.

7. Data Deletion and Retention
The table below lists the personal data used by Cognitive Intelligence, the length of time that data needs to be retained, andwhy we retain it.
Type of Personal Data

Retention Period

Reason for Retention

Registration Information 8•

Upon request••

Security administration and operations
General product enablement

Web Log Usage and EventData9••90 daysUpon request•

90 days: Security administration and operations, providing security
analytics, forensics, and general product enablement
Deleted upon request: product improvement, applied research,efficacy research, and global threat intelligence research

90 daysUpon request•

NetFlow Usage and EventData••••

90 days: Security administration and operations, providing security
analytics, forensics, and general product enablement
Deleted upon request: product improvement, applied research,efficacy research, and global threat intelligence research

8Registration Information data is currently retained indefinitely in the UK data center. When a customer terminates its Cognitive Intelligence
subscription, it can specifically request that its Registration Information be purged from Cisco’s data storage and backups by opening a Cisco
TAC case.
9For event data, ninety (90) day time-based “First-in-First-Out” data store is used to capture and store usage and event data for presentation ofcustomer specific threat events Cognitive Intelligence. The prescribed retention period is defined in accordance with a look-back window forwhich threat events and forensic information is available to the customer within Cognitive Intelligence. A large portion of event data collectedare behaviors, statistics and metadata extracted from the source telemetry. Event Data may be kept for mining, efficacy research, and global
threat intelligence research purposes. When a customer terminates its subscription, it can specifically request that its data be purge from
Cisco’s data storage and backups by opening a Cisco TAC case. For source telemetry, data will be deleted ninety (90) days after processing.
However, for any source telemetry directly associated with suspected or confirmed infections may be retained indefinitely for data mining,
efficacy research and global threat intelligence purposes.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 2.1, August 30, 2022

Privacy Data Sheet

Doc type
Cisco public
Firewall Event Data and Logs••

90 daysUpon request•

90 daysUpon request••

90 days: Security administration and operations, providing security
analytics, forensics, and general product enablement
Deleted upon request: product improvement, applied research,efficacy research, and global threat intelligence research

Enhanced NetFlow Usage andEvent Data for Encrypted
Traffic Analytics (ETA)••

Web and API Usage Log•

3 years•

Security administration and operations, providing security analytics,forensics, and general product enablement

Secure Endpoint Event Log
Usage and Event Data••

90 daysUpon request•

90 days: Security administration and operations, providing securityanalytics, forensics, and general product enablement
Deleted upon request: product improvement, applied research,efficacy research, and global threat intelligence research

Customer Submitted Files•

24 months•

Product improvement, applied research, efficacy research, and global
threat intelligence research

SPAD Reports•

90 days•

Improve customer experience, advise on appropriate configurationand deployment, assist with interpretation of threat detections,general product enablement, and integration with other Cisco andthird-party products••

90 days: Security administration and operations, providing security
analytics, forensics, and general product enablement
Deleted upon request: product improvement, applied research,efficacy research, and global threat intelligence research

8. Personal Data Security
Cisco has implemented appropriate technical and organizational measures designed to secure personal data from accidental
loss and unauthorized access, use, alteration, and disclosure
Personal Data Category

Security Controls and Measures

Registration Information••

Encrypted in transit via TLS/SSL
Encrypted at rest

Web Log Usage and Event Data•
•Cisco/AWS: Encrypted in transit via TLS/SSL; encrypted at rest
Equinix/Vazata; Encrypted in transit via TLS/SSL; protected at rest by access control

NetFlow Usage and Event Data••

Cisco/AWS: Encrypted in transit via TLS/SSL; encrypted at rest
Equinix/Vazata; Encrypted in transit via TLS/SSL; protected at rest by access control

Firewall Event Data and Logs••

Cisco/AWS: Encrypted in transit via TLS/SSL; encrypted at rest
Equinix/Vazata; Encrypted in transit via TLS/SSL; protected at rest by access control

Enhanced NetFlow Usage and Event Datafor Encrypted Traffic Analytics (ETA)••

Cisco/AWS: Encrypted in transit via TLS/SSL; encrypted at rest
Equinix/Vazata; Encrypted in transit via TLS/SSL; protected at rest by access control

Web and API Usage Log••

Encrypted in transit via TLS/SSL
Encrypted at rest

Secure Endpoint Event Log Usageand Event Data••

Encrypted in transit via TLS/SSLEncrypted at rest

Customer Submitted Files••

Encrypted in transit via TLS/SSL
Encrypted at rest

SPAD Reports••

Encrypted in transit via TLS/SSL
Encrypted at rest©2022 Cisco and/or its affiliates. All rights reserved.

Version 2.1, August 30, 2022

Privacy Data Sheet

Doc type
Cisco public

9. Sub-processors
Cisco partners with service providers that act as sub-processors and contract to provide the same level of data protection andinformation security that you can expect from Cisco. A current list of sub-processors for the service is below:Sub-processor

Personal DataService Type

Location of Data
CenterAWS•

Web Log Usage andEvent Data
NetFlow Usage andEvent Data
Enhanced Netflow Usageand Event Data for
Encrypted Traffic
Analytics (ETA)
Web and API Usage Log
Secure Endpoint EventLog Usage and EventData
Customer Submitted
Files

Cisco leverages the AWS cloud to help provide
security assurance, service elasticity, and resilienceto Cognitive Intelligence

Ireland
USA - Virginia•••••

Equinix•

Any personal data that
may be contained in a filesubmitted for analysis

Equinix is a Cisco-approved third party co-locationfacility used by Cisco Talos for global threat
intelligence research

USA – California,Texas, Virginia

Vazata•Any personal data that
may be contained in a filesubmitted for analysis

Vazata is a Cisco-approved third party co-location
facility used by Cisco TIP for global threat intelligence
research

USA - Texas

10. Information Security Incident Management
Breach and Incident Notification Processes
The Information Security team within Cisco’s Security & Trust Organization coordinates the Data Incident Response Process andmanages the enterprise-wide response to data-centric incidents. The Incident Commander directs and coordinates Cisco’s
response, leveraging diverse teams including the Cisco Product Security Incident Response Team (PSIRT), the Cisco SecurityIncident Response Team (CSIRT), and the Advanced Security Initiatives Group (ASIG).
PSIRT manages the receipt, investigation, and public reporting of security vulnerabilities related to Cisco products andnetworks. The team works with Customers, independent security researchers, consultants, industry organizations, and othervendors to identify possible security issues with Cisco products and networks. The Cisco Security Center details the process forreporting security incidents.
The Cisco Notification Service allows Customers to subscribe and receive important Cisco product and technology information,
including Cisco security advisories for critical and high severity security vulnerabilities. This service allows Customers to choose
the timing of notifications, and the notification delivery method (email message or RSS feed). The level of access is determinedby the subscriber's relationship with Cisco. If you have questions or concerns about any product or security notifications,contact your Cisco sales representative.

11. Certifications and Compliance with Privacy Requirements
The Security & Trust Organization and Cisco Legal provide risk and compliance management and consultation services to help
drive security and regulatory compliance into the design of Cisco products and services. The Service is built with privacy in mind
and is designed so that it can be used in a manner consistent with global privacy requirements.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 2.1, August 30, 2022

Privacy Data Sheet

Doc type
Cisco public

In addition to the Cross-Border Data Transfer Mechanisms/Certifications listed in Section 4, Cisco has the following:••

EU-US Privacy Shield Framework
Swiss-US Privacy Shield Framework

Further, in addition to complying with our stringent internal standards, Cisco also maintains third-party validations todemonstrate our commitment to information security.

12. Exercising Data Subject Rights
Users whose personal data is processed by the Service have the right to request access, rectification, suspension of processing,or deletion of the personal data processed by the Service.
We will confirm identification (typically with the email address associated with a Cisco account) before responding to therequest. If we cannot comply with the request, we will provide an explanation. Please note, users whose employer is theCustomer/Controller, may be redirected to their employer for a response.
Requests can be made by submitting a request via:
1) the Cisco Privacy Request form
2) by postal mail:Chief Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAmericas Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAPJC Privacy Officer
Cisco Systems, Inc.
Bldg 80, Lvl 25, Mapletree Biz City,80 Pasir Panjang Road,Singapore, 117372
SINGAPORE

EMEAR Privacy Officer
Cisco Systems, Inc.
Haarlerbergweg 13-19, 1101 CH
Amsterdam-Zuidoost NETHERLANDS

We will endeavor to timely and satisfactorily respond to inquiries and requests. If a privacy concern related to the personal dataprocessed or transferred by Cisco remains unresolved, contact Cisco’s US-based third-party dispute resolution provider.
Alternatively, you can contact the data protection supervisory authority in your jurisdiction for assistance. Cisco’s mainestablishment in the EU is in the Netherlands. As such, our EU lead authority is the Dutch Autoritiet Persoonsgegevens.

13. General Information
For more general information and FAQs related to Cisco’s Security and Privacy Program please visit The Cisco Trust Center.
Cisco Privacy Data Sheets are reviewed and updated on an annual, or as needed, basis. For the most current version, go to the
Personal Data Privacy section of the Cisco Trust Center.
To receive email notifications of updates to the Privacy Data Sheet, click the “Subscribe” link in the upper right corner of theTrust Portal.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 2.1, August 30, 2022