A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?
You are configuring a new Logstash data collector to ingest logs into Cortex XSIAM. Which specific component must be deployed within the customer environment to facilitate secure, authenticated log forwarding?
A security analyst at a retail company suspects that an attacker used a compromised service account to perform lateral movement via SMB. The analyst wants to identify all unique hosts that the account connected to over the past 24 hours using Cortex XSIAM's XQL. Which query structure will correctly return the distinct destination IP addresses for the specified account and protocol?
A Cortex XSIAM administrator is planning to ingest logs from a custom application that writes JSON-formatted events to a local file on a Linux server. The administrator wants to use the Broker VM to collect these logs. Which two components must be configured on the Broker VM to enable this log collection? (Choose two.)
A SOC analyst is building an XQL query against the Cortex XSIAM `xdr_data` dataset to identify all network connections made by a specific process. The analyst writes: `dataset = xdr_data | filter event_type = NETWORK and actor_process_image_name = "chrome.exe" | fields agent_hostname, action_remote_ip, action_remote_port`. After running the query, the analyst notices the results are missing columns for the remote IP and port. Which action should the analyst take to return the expected data?
A security engineer is configuring a new correlation rule in Cortex XSIAM to detect a specific attack pattern. They need to define the rule's logic using XQL. Which two XQL clauses are essential for defining the time window and the condition that triggers the alert? (Choose two.)
A SOC manager wants to ensure that Cortex XSIAM automatically enriches incidents with threat intelligence and then routes them to the correct analyst queue based on severity. Which two configurations are required to achieve this? (Choose two.)
A Cortex XSIAM administrator is configuring a new data source that sends logs in a custom JSON format. The logs contain a field named 'src_ip' that should map to the XDM 'action_local_ip' field. However, after ingestion, the XDM field is not populated. The administrator has verified that the logs are arriving and the parsing rules are applied. What is the most likely reason for the mapping failure?
A Cortex XSIAM administrator is creating a new custom dashboard for the security operations center. The dashboard must show a count of incidents by severity, a trend of alerts over the last seven days, and a table of the top ten most frequent MITRE ATT&CK techniques observed. Which two widget types should the administrator use to build these components? (Choose two.)
An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?
You are troubleshooting an issue where a specific detection rule is failing to trigger despite matching log data. Which tool allows you to simulate the detection rule against historical data?
When setting up an alert threshold in Cortex XSIAM, you want to avoid 'alert fatigue'. Which feature helps aggregate related alerts into a single actionable item?
You are integrating a custom threat intelligence feed into Cortex XSIAM. Where must this feed be defined to ensure it is utilized by the XSIAM correlation engine?
A security analyst at a retail company is investigating a Cortex XSIAM incident that shows an unusual outbound connection from a point-of-sale terminal to a known command-and-control IP. The analyst wants to gather additional context about the process that initiated the connection without leaving the incident view. Which XSIAM feature should the analyst use to retrieve process details, parent-child relationships, and command-line arguments?
A security analyst is investigating a possible insider threat. They need to see all normal activity for a specific user over the past 90 days to establish a baseline before reviewing anomalous events. Which Cortex XSIAM capability should they use to efficiently visualize this historical, entity-centric data?
A security analyst at a healthcare company notices that a Cortex XSIAM correlation rule is generating an incident every time a clinician accesses a patient record after hours, even though the access is expected during on-call shifts. The analyst wants to stop these recurring incidents without disabling the underlying rule entirely. Which action should the analyst take?
A security analyst is triaging a malware incident in Cortex XSIAM. The analyst wants to isolate the affected Windows endpoint from the network directly from the incident's War Room while preserving the forensic evidence on the disk. Which action should the analyst take?
A Cortex XSIAM administrator is configuring a new correlation rule to detect brute-force attacks against a cloud identity provider. The rule should trigger only when there are more than 10 failed authentication events from the same source IP within a 5-minute window. Which XSIAM component should the administrator use to define this time-based aggregation logic?
A Cortex XSIAM administrator needs to ensure that all endpoint telemetry from a critical server group is collected and forwarded to the platform, even if the endpoint's network connection is intermittent. The solution must be resilient and not lose data during outages. Which component of the Cortex XSIAM agent architecture is responsible for this reliable data handling?
A SOC manager wants Cortex XSIAM to automatically enrich every new incident with the reputation of the involved IP addresses before an analyst opens it. Which Cortex XSIAM capability should the manager use to accomplish this?
A Cortex XSIAM administrator needs to ensure that a newly onboarded cloud log source is parsed correctly so that its events map to the XDM fields used by correlation rules. The raw logs arrive in JSON format with vendor-specific field names. Which Cortex XSIAM capability should the administrator use to normalize these fields?
A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)
A Cortex XSIAM analyst is investigating an incident and wants to see the sequence of causally related events that led to a suspicious process execution, including parent-child relationships across endpoints. Which Cortex XSIAM feature should the analyst use?
A SOC analyst is building a scheduled XQL query in Cortex XSIAM that must run every 15 minutes and automatically create a high-severity incident whenever a Cortex XDR endpoint generates a 'Malware Detected' event on a server asset. The analyst has written the query and validated the results manually. Which XSIAM component must the analyst configure to make this query run on a schedule and generate the incident automatically?
A Cortex XSIAM administrator needs to grant a new tier-1 analyst the ability to view and triage incidents but not to modify correlation rules or delete data. Which Cortex XSIAM access control mechanism should the administrator configure?
A Cortex XSIAM administrator is designing a detection strategy for credential abuse. The administrator wants to leverage XQL to identify suspicious authentication behavior. Which two XQL capabilities should the administrator use to detect a user account that authenticates successfully from multiple geographically distant locations within a short time window? (Choose two.)
A security engineer is onboarding a new firewall log source into Cortex XSIAM. Raw logs are arriving in the tenant and are visible in the raw data view, but the parsed events show empty fields for source IP, destination IP, and action, and no incidents are being generated from this source. The engineer needs to correct the parsing so the fields populate and detections can fire. Which two actions should the engineer take? (Choose two.)
A Cortex XSIAM analyst is reviewing an incident and wants to see the raw, unnormalized log entries that contributed to the alert. The analyst needs to examine the original fields as they were received from the source. Where in the incident investigation interface can the analyst access these raw logs?
A security engineer is configuring a correlation rule in Cortex XSIAM to detect brute-force attacks. The rule should trigger only when more than 10 failed login attempts occur from the same source IP within 5 minutes. The engineer creates a rule with a `match` stage on `action_local_ip` and a `timeframe` of 5 minutes, but the rule fires on every failed login. Which configuration change is required to make the rule behave as intended?
A security operations center (SOC) manager wants to ensure that all analysts can quickly see which incidents are assigned to them and their current status. Which Cortex XSIAM dashboard component should the manager use to display a personalized list of incidents for each analyst?
A Cortex XSIAM administrator wants to give a new analyst the ability to view and triage incidents but not to modify playbooks or system configurations. Which Cortex XSIAM mechanism should the administrator use to enforce this?
A tier-one analyst receives a Cortex XSIAM incident about a suspicious PowerShell execution on a finance workstation. The analyst wants to immediately determine what the process did on the endpoint, including its parent process, command-line arguments, and any child processes it spawned, without leaving the incident view. Which XSIAM capability should the analyst use?
A Cortex XSIAM administrator needs to create a custom XQL query that correlates failed login events from the 'auth_logs' dataset with successful login events from the same dataset, matching on the 'user' field, to detect potential account compromise. Which XQL operator should the administrator use to combine these two event sets?
A SOC manager wants Cortex XSIAM to automatically contain a compromised endpoint the moment a 'Credential Dumping' incident is created, but only when the affected asset is tagged as a production server. The team already has a playbook that performs endpoint isolation. The manager wants the playbook to run only under those precise conditions without modifying the playbook's internal tasks. Where should the manager configure this conditional execution?
An analyst investigating a Cortex XSIAM incident wants to find every process on the affected endpoint that established an outbound network connection to a suspicious external IP address over the past 30 days, including processes that are no longer running. The analyst needs to query historical telemetry rather than view current process state. Which approach should the analyst use?
A security analyst is investigating an incident in Cortex XSIAM and wants to see the chronological sequence of all activities related to a specific host, including process executions, network connections, and registry modifications. Which XSIAM feature should the analyst use to obtain this timeline view?
A Cortex XSIAM administrator needs to ensure that a specific XQL query used in a correlation rule runs efficiently and does not scan unnecessary data. The query currently filters on `event_type = PROCESS` and `actor_process_image_name = "powershell.exe"`. The dataset contains billions of events. Which optimization technique should the administrator apply to reduce query execution time?
A Cortex XSIAM administrator is onboarding a new cloud audit log source that delivers events in JSON. The vendor's events include a unique correlation identifier that must be preserved exactly as received, including leading zeros, so that downstream correlation rules can join related activities. During data model mapping, which field type should the administrator assign to this identifier to prevent the normalization layer from stripping leading zeros or converting the value?
A Cortex XSIAM administrator is tuning a correlation rule that currently generates a high volume of false positives. The rule uses an XQL query that matches on a field named action with the value 'login'. The administrator wants the rule to fire only when the same source IP performs more than five failed logins within ten minutes, and to suppress duplicate alerts for the same source IP for one hour after the first alert. Which combination of XQL constructs and rule settings should the administrator use?