During an investigation, you observe multiple alerts originating from a single endpoint. You want to group these alerts into a single incident to simplify the analysis. Which feature allows this?
An analyst is investigating a malware alert on a Windows endpoint. In the Cortex XDR alert details, the Causality View shows a process named `powershell.exe` with a child process `rundll32.exe`. The analyst right-clicks `rundll32.exe` and selects 'Add to Block List'. What is the immediate effect of this action?
A Cortex XDR administrator needs to ensure that a PowerShell script executed on a Windows endpoint is scanned by the local WildFire engine before it is allowed to run, even if the endpoint is offline. The administrator creates a new Malware profile. Which action setting for the Portable Executable and DLL file type should be selected to meet this requirement?
A Cortex XDR administrator is configuring a new exception rule to prevent false positives from a custom administrative tool. The tool performs actions that trigger Behavioral Threat Protection (BTP) alerts. The administrator wants to ensure the exception applies only to this tool and does not weaken security posture. Which two criteria can be used to define the exception in a BTP profile? (Choose two.)
A Cortex XDR administrator needs to ensure that all endpoint agents automatically receive the latest security policies and content updates without manual intervention. Which component is responsible for this?
A Cortex XDR analyst is creating a custom detection rule using the XQL query language. The analyst wants to ensure the rule triggers only when a specific process (e.g., 'powershell.exe') is executed with a command line containing 'Invoke-Expression' and establishes a network connection to an external IP address within 5 minutes. Which TWO XQL operators or clauses should the analyst use to correlate the process execution and network connection events? (Choose two.)
A Cortex XDR administrator needs to ensure that all endpoints in a high-security zone automatically block known malicious files based on threat intelligence. The administrator wants to minimize manual intervention and ensure the block is applied even if the endpoint is offline. Which configuration should be used?
A Cortex XDR analyst receives an alert about a suspicious PowerShell script executed on a server. The analyst wants to quickly determine the script's content and its network connections without disrupting the server. Which combination of Cortex XDR features should the analyst use?
A Cortex XDR administrator needs to prevent a known malicious driver (hash: 7a3b9c2d1e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b) from loading on all Windows endpoints in the organization. The administrator wants a policy-based, scalable solution that does not rely on manual intervention per endpoint. What should the administrator do?
You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?
You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?
A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?
An analyst is investigating an alert where a process launched by Microsoft Word spawned a child process that executed an encoded PowerShell command. The analyst wants to view the full process lineage, including parent-child relationships and command-line arguments, for this specific alert. Which Cortex XDR feature should the analyst use?
A security analyst wants to block a known malicious hash across all endpoints managed by Cortex XDR. Which component should the analyst use to enforce this block?
A Cortex XDR administrator is configuring a new External Data Ingestion (EDI) integration to collect logs from a third-party cloud application. The administrator needs to ensure that the logs are parsed and mapped to Cortex XDR's data model for correlation with endpoint telemetry. Which configuration step is mandatory to achieve this?
A Cortex XDR analyst is investigating a suspected ransomware incident on a Windows endpoint. The analyst has identified the malicious process but needs to quickly determine whether it spawned any child processes and what those children did. Which feature within the Cortex XDR console provides this information in a visual timeline?
A security analyst is investigating a high-severity alert in Cortex XDR. The alert details show a process named 'svchost.exe' with a parent process 'services.exe'. The analyst notices that the 'svchost.exe' process has a digital signature from Microsoft but is exhibiting unusual network behavior, connecting to an external IP address on port 443. The analyst wants to determine if this is a malicious process injection. Which Cortex XDR feature should the analyst use to inspect the memory of the 'svchost.exe' process?
A security operations center (SOC) manager wants to reduce the number of false positive alerts generated by Cortex XDR. Which two features can be used to tune alert generation and reduce noise? (Choose two.)
A security analyst needs to ensure that all endpoints in the organization are protected against a newly discovered fileless malware that exploits PowerShell. The analyst wants to configure Cortex XDR to block this threat automatically. Which component should the analyst configure?
An analyst needs to collect and analyze forensic data from a compromised endpoint without disrupting the user's work. The endpoint is running Windows 10 and has the Cortex XDR agent installed. Which capability should the analyst use?
A Cortex XDR administrator needs to ensure that all endpoint agents are reporting to the correct tenant and that the agent version is up to date. Which section of the Cortex XDR console provides a centralized view of endpoint agent status, including version, last seen time, and operational status?
A Cortex XDR administrator needs to ensure that all endpoint agents can communicate with the Cortex XDR management console even when endpoints are behind a proxy. Which configuration should the administrator verify?
A security analyst is investigating a potential data exfiltration incident. The analyst needs to identify all external IP addresses that a specific endpoint has communicated with over the past 7 days. Which Cortex XDR feature should the analyst use?
A security analyst is investigating an alert in Cortex XDR and wants to see the raw endpoint data that contributed to the alert, including registry modifications and network connections. Which console section should the analyst use to query this data directly?
A Cortex XDR administrator is configuring a new policy to restrict USB device usage on endpoints. The administrator wants to allow only specific USB devices while blocking all others. Which two actions must be performed to achieve this? (Choose two.)
A Cortex XDR analyst is troubleshooting why a specific endpoint is not sending telemetry to the console. The analyst checks the agent status and sees that it is connected but no new events are appearing. Which action should the analyst take first to diagnose the issue?
A Cortex XDR administrator is configuring a new alert exclusion rule to reduce noise from a legitimate application that frequently triggers behavioral alerts. The administrator wants to ensure that the exclusion applies only to the specific endpoint group 'Finance' and only for alerts generated by the 'Credential Dumping' category. Which configuration should the administrator use?
A Cortex XDR analyst is investigating a high-severity alert involving a suspicious process on a critical server. The analyst needs to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?