Cortex XSIAM

What is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?

An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?

You are troubleshooting an issue where a specific detection rule is failing to trigger despite matching log data. Which tool allows you to simulate the detection rule against historical data?

In Cortex XSIAM, you want to automate the response to a specific type of Phishing alert. Where do you configure the automated execution logic?

When setting up an alert threshold in Cortex XSIAM, you want to avoid 'alert fatigue'. Which feature helps aggregate related alerts into a single actionable item?

You are integrating a custom threat intelligence feed into Cortex XSIAM. Where must this feed be defined to ensure it is utilized by the XSIAM correlation engine?

What is the purpose of the 'XDM' (XSIAM Data Model) in Cortex XSIAM?

Which dashboard component provides an overview of the current security posture and active threats in the XSIAM environment?

A user is reporting that their XSIAM dashboard widgets are displaying 'No Data'. What is the most likely cause?

When using XQL to join two datasets, which keyword is mandatory for combining information from separate tables?

An administrator needs to restrict access to specific sensitive incident logs. Which XSIAM feature should be used to enforce this access control?

What is the primary benefit of using Cortex XSIAM's 'Unified SOC' capability?

What is the purpose of the 'XSIAM Agent' exclusion list?

An investigation indicates a process is being blocked by Cortex XSIAM's agent. Where can you find the specific block event log?

Which feature in Cortex XSIAM is specifically designed for long-term storage of logs to meet compliance requirements?

If you want to modify the data model mapping for an incoming log source, which menu path is most appropriate?

When reviewing an incident in the Investigation area, what does the 'Graph' view display?

Which TWO of the following are valid ways to ingest log data into Cortex XSIAM?

Which TWO of the following are considered 'Entities' in the Cortex XSIAM investigation workbench?

Which THREE items can be performed within the XSIAM Playbook editor?

Which THREE of the following represent common data sources for Cortex XSIAM?

Which TWO features are included in the Cortex XSIAM 'Unified SOC' dashboard capabilities?

Which TWO of the following are benefits of using the XDM schema in XSIAM?

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Which THREE elements must be considered when configuring a Log Forwarder in Cortex XSIAM?

You are creating a new detection rule. How do you ensure it only alerts on specific high-severity events?

A security analyst at a retail company is investigating a Cortex XSIAM incident that shows an unusual outbound connection from a point-of-sale terminal to a known command-and-control IP. The analyst wants to gather additional context about the process that initiated the connection without leaving the incident view. Which XSIAM feature should the analyst use to retrieve process details, parent-child relationships, and command-line arguments?

A security analyst is investigating a possible insider threat. They need to see all normal activity for a specific user over the past 90 days to establish a baseline before reviewing anomalous events. Which Cortex XSIAM capability should they use to efficiently visualize this historical, entity-centric data?

A security analyst at a healthcare company notices that a Cortex XSIAM correlation rule is generating an incident every time a clinician accesses a patient record after hours, even though the access is expected during on-call shifts. The analyst wants to stop these recurring incidents without disabling the underlying rule entirely. Which action should the analyst take?

A security analyst is triaging a malware incident in Cortex XSIAM. The analyst wants to isolate the affected Windows endpoint from the network directly from the incident's War Room while preserving the forensic evidence on the disk. Which action should the analyst take?

A Cortex XSIAM administrator is configuring a new correlation rule to detect brute-force attacks against a cloud identity provider. The rule should trigger only when there are more than 10 failed authentication events from the same source IP within a 5-minute window. Which XSIAM component should the administrator use to define this time-based aggregation logic?

A Cortex XSIAM administrator needs to ensure that all endpoint telemetry from a critical server group is collected and forwarded to the platform, even if the endpoint's network connection is intermittent. The solution must be resilient and not lose data during outages. Which component of the Cortex XSIAM agent architecture is responsible for this reliable data handling?

A SOC manager wants Cortex XSIAM to automatically enrich every new incident with the reputation of the involved IP addresses before an analyst opens it. Which Cortex XSIAM capability should the manager use to accomplish this?

A Cortex XSIAM administrator needs to ensure that a newly onboarded cloud log source is parsed correctly so that its events map to the XDM fields used by correlation rules. The raw logs arrive in JSON format with vendor-specific field names. Which Cortex XSIAM capability should the administrator use to normalize these fields?

A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)

A Cortex XSIAM analyst is investigating an incident and wants to see the sequence of causally related events that led to a suspicious process execution, including parent-child relationships across endpoints. Which Cortex XSIAM feature should the analyst use?

A SOC analyst is building a scheduled XQL query in Cortex XSIAM that must run every 15 minutes and automatically create a high-severity incident whenever a Cortex XDR endpoint generates a 'Malware Detected' event on a server asset. The analyst has written the query and validated the results manually. Which XSIAM component must the analyst configure to make this query run on a schedule and generate the incident automatically?

A Cortex XSIAM administrator needs to grant a new tier-1 analyst the ability to view and triage incidents but not to modify correlation rules or delete data. Which Cortex XSIAM access control mechanism should the administrator configure?

A Cortex XSIAM administrator is designing a detection strategy for credential abuse. The administrator wants to leverage XQL to identify suspicious authentication behavior. Which two XQL capabilities should the administrator use to detect a user account that authenticates successfully from multiple geographically distant locations within a short time window? (Choose two.)

A security engineer is onboarding a new firewall log source into Cortex XSIAM. Raw logs are arriving in the tenant and are visible in the raw data view, but the parsed events show empty fields for source IP, destination IP, and action, and no incidents are being generated from this source. The engineer needs to correct the parsing so the fields populate and detections can fire. Which two actions should the engineer take? (Choose two.)

A Cortex XSIAM analyst is reviewing an incident and wants to see the raw, unnormalized log entries that contributed to the alert. The analyst needs to examine the original fields as they were received from the source. Where in the incident investigation interface can the analyst access these raw logs?

A security engineer is configuring a correlation rule in Cortex XSIAM to detect brute-force attacks. The rule should trigger only when more than 10 failed login attempts occur from the same source IP within 5 minutes. The engineer creates a rule with a `match` stage on `action_local_ip` and a `timeframe` of 5 minutes, but the rule fires on every failed login. Which configuration change is required to make the rule behave as intended?

A security operations center (SOC) manager wants to ensure that all analysts can quickly see which incidents are assigned to them and their current status. Which Cortex XSIAM dashboard component should the manager use to display a personalized list of incidents for each analyst?

A Cortex XSIAM administrator wants to give a new analyst the ability to view and triage incidents but not to modify playbooks or system configurations. Which Cortex XSIAM mechanism should the administrator use to enforce this?

A tier-one analyst receives a Cortex XSIAM incident about a suspicious PowerShell execution on a finance workstation. The analyst wants to immediately determine what the process did on the endpoint, including its parent process, command-line arguments, and any child processes it spawned, without leaving the incident view. Which XSIAM capability should the analyst use?

A Cortex XSIAM administrator needs to create a custom XQL query that correlates failed login events from the 'auth_logs' dataset with successful login events from the same dataset, matching on the 'user' field, to detect potential account compromise. Which XQL operator should the administrator use to combine these two event sets?

A SOC manager wants Cortex XSIAM to automatically contain a compromised endpoint the moment a 'Credential Dumping' incident is created, but only when the affected asset is tagged as a production server. The team already has a playbook that performs endpoint isolation. The manager wants the playbook to run only under those precise conditions without modifying the playbook's internal tasks. Where should the manager configure this conditional execution?

An analyst investigating a Cortex XSIAM incident wants to find every process on the affected endpoint that established an outbound network connection to a suspicious external IP address over the past 30 days, including processes that are no longer running. The analyst needs to query historical telemetry rather than view current process state. Which approach should the analyst use?

A security analyst is investigating an incident in Cortex XSIAM and wants to see the chronological sequence of all activities related to a specific host, including process executions, network connections, and registry modifications. Which XSIAM feature should the analyst use to obtain this timeline view?

A Cortex XSIAM administrator needs to ensure that a specific XQL query used in a correlation rule runs efficiently and does not scan unnecessary data. The query currently filters on `event_type = PROCESS` and `actor_process_image_name = "powershell.exe"`. The dataset contains billions of events. Which optimization technique should the administrator apply to reduce query execution time?

A Cortex XSIAM administrator is onboarding a new cloud audit log source that delivers events in JSON. The vendor's events include a unique correlation identifier that must be preserved exactly as received, including leading zeros, so that downstream correlation rules can join related activities. During data model mapping, which field type should the administrator assign to this identifier to prevent the normalization layer from stripping leading zeros or converting the value?

A Cortex XSIAM administrator is tuning a correlation rule that currently generates a high volume of false positives. The rule uses an XQL query that matches on a field named action with the value 'login'. The administrator wants the rule to fire only when the same source IP performs more than five failed logins within ten minutes, and to suppress duplicate alerts for the same source IP for one hour after the first alert. Which combination of XQL constructs and rule settings should the administrator use?