Identity Threat Detection And Response

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

An analyst is investigating a suspected pass-the-ticket attack where an attacker injects a stolen Kerberos ticket into memory. Which endpoint telemetry data collected by the Cortex XDR Agent helps identify abnormal process behavior related to ticket injection tools (such as Mimikatz 'kerberos::ptt')

An analyst is reviewing an XQL query designed to hunt for suspicious account creation followed by immediate group membership escalation in Active Directory. Which XQL construct is used to join Active Directory event datasets based on a common security identifier (SID)?

A security analyst suspects an account compromise after noticing multiple rapid logins from geographically distant IP addresses within minutes. Which Cortex XDR feature automatically aggregates these related anomalous authentication indicators into a single incident?

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

Which THREE configuration steps are required to ensure Cortex XDR successfully correlates endpoint events with Active Directory user identities?

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

An analyst is investigating an incident where an attacker leveraged compromised credentials to establish persistence via Active Directory object manipulation. Which TWO Active Directory event logs or actions captured by ITDR monitoring should the analyst examine?

Which THREE indicators collected by Cortex XDR endpoint agents are crucial for identifying post-exploitation credential harvesting activities on a host?

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

An analyst needs to verify whether Active Directory audit policies are correctly configured to supply Cortex XDR with the necessary event logs for Identity Threat Detection and Response. Which Windows Event ID range contains the core authentication and credential validation events required by Cortex XDR ITDR?

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

Which TWO data sources can Cortex XDR leverage to build comprehensive user identity behavior profiles for ITDR? (Choose two)

When deploying and troubleshooting the integration between Cortex XDR and Active Directory for ITDR, which TWO steps or configurations are critical to ensure successful telemetry collection? (Choose two)

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

A Cortex XDR analyst is investigating repeated failed authentications against a domain controller from a single workstation. The failures are followed by one success from the same workstation, after which the account begins accessing file shares it has never touched before. The analyst needs to preserve the identity context while correlating the authentication events with subsequent file activity. Which Cortex XDR capability should the analyst use to pivot from the authentication events to the related endpoint activity?

A Cortex XDR analyst is investigating an identity alert where a helpdesk technician account successfully authenticated to 14 different workstations within 3 minutes, each logon using explicit credentials rather than interactive console logon. The account has no associated change ticket. Which identity-based detection concept best explains why Cortex XDR raised this as a high-severity alert?

A Cortex XDR analyst is investigating a suspected pass-the-hash attack. The attacker has captured an NTLM hash and is using it to authenticate to multiple servers without knowing the plaintext password. Which Cortex XDR data source would most directly reveal the anomalous NTLM authentication events indicating this attack?

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse legitimate credentials rather than malware. The analyst needs to select identity behaviors that should generate high-fidelity alerts because they strongly indicate credential misuse rather than normal user activity. (Choose two.)

A Cortex XDR analyst is responding to an alert indicating a Golden Ticket attack. The attacker has compromised the KRBTGT account hash and is forging Kerberos ticket-granting tickets (TGTs) to maintain persistent access. Which TWO Cortex XDR capabilities are most effective for detecting and investigating this attack? (Choose two.)

A Cortex XDR administrator wants the platform to automatically disable a user account in Active Directory when an identity alert indicates confirmed active credential compromise, without analyst intervention. Which Cortex XDR capability should the administrator configure to achieve this?

A Cortex XDR administrator wants to review which user accounts have the highest identity risk based on recent authentication anomalies and privilege changes. The administrator needs a consolidated view that ranks users by their accumulated risk indicators across the environment. Which Cortex XDR feature should the administrator open to obtain this ranked list of at-risk identities?

During an identity investigation in Cortex XDR, an analyst observes a service account performing a Kerberoasting-style request pattern: multiple TGS requests for accounts with Service Principal Names, followed by an anomalous LDAP query enumerating domain admins. The service account normally runs a backup job nightly. Which interpretation should guide the analyst's next action?

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

During an investigation, a Cortex XDR analyst observes that a user account successfully authenticated to a server and then, within seconds, accessed a credential store file on that server. The analyst wants to determine whether the account's credentials were subsequently used from a different host. Which Cortex XDR data should the analyst examine to trace whether the stolen credentials were reused elsewhere?

During an ITDR investigation, an analyst sees a Cortex XDR identity alert: a privileged user authenticated successfully to three different SaaS applications from two countries within 12 minutes. MFA was satisfied via push notification on each attempt. The analyst needs to determine whether this is a legitimate VPN egress or a session-token replay. Which Cortex XDR identity data point best distinguishes session-token theft from legitimate travel?

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

During an ITDR investigation, an analyst observes that a service account authenticated to a domain controller and then created a new computer object. The analyst wants to determine whether this is a known attack technique involving directory object manipulation. Which Cortex XDR analytic or rule category is MOST relevant to this behavior?

A Cortex XDR analyst receives an alert that a privileged account was added to the Domain Admins group outside of a change window. The analyst wants to immediately review the account's recent activity and the group membership change in a single identity-focused investigation context. Where should the analyst navigate to review this identity event alongside the account's related activity?

A Cortex XDR analyst receives an ITDR alert indicating a user account performed a Kerberoasting attack against multiple service principal names. The analyst wants to quickly identify every host and process that requested the service tickets to scope the incident. Which Cortex XDR capability should the analyst use?

An analyst reviewing a Cortex XDR identity incident sees that a user's account successfully authenticated from an unfamiliar ASN at 02:00, immediately followed by creation of a new mail forwarding rule and a password reset. The user confirms they were asleep and did not perform these actions. Which conclusion and immediate priority are most appropriate?

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

A Cortex XDR administrator wants to ensure that when an identity-based attack is detected, the platform can automatically disable the compromised user account in the identity provider. Which integration must be configured to enable this automated response?

A security operations manager wants analysts to quickly see, for any user in Cortex XDR, a consolidated timeline of authentication events, accessed resources, and associated alerts across the environment. Which Cortex XDR feature should analysts use to obtain this per-user consolidated view?

A Cortex XDR analyst is building an ITDR detection strategy for an environment using Microsoft Entra ID and on-premises Active Directory. The analyst wants to identify identity-based attacks that span both cloud and on-premises authentication. Which TWO Cortex XDR data sources provide the authentication telemetry needed to correlate cloud sign-ins with on-premises logons? (Choose two.)

A Cortex XDR analyst is investigating a suspected credential dumping attack on a Windows endpoint. The attacker used a tool that accessed LSASS memory to extract credentials. Which Cortex XDR capability would most directly detect this activity by monitoring for unauthorized access to LSASS?

An analyst is reviewing a Cortex XDR identity alert where a user authenticated with a valid password but from a device that has never been associated with that user. The analyst wants to assess whether the account's privileges make this a high-risk event. Which Cortex XDR data source provides the user's group memberships and role assignments to support this assessment?

An analyst is investigating an ITDR incident in Cortex XDR where an attacker used a compromised service account to create a new domain admin account. The analyst needs to review the sequence of authentication and directory-change events leading to the new account creation. Which Cortex XDR feature provides a chronological, identity-centric timeline for this investigation?

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse valid credentials. Which TWO identity risk signals should the analyst prioritize to detect credential misuse rather than credential theft? (Choose two.)

A Cortex XDR analyst is investigating an alert where a domain user account triggered the 'First Seen Kerberos Service Ticket Request for User' BIOC. The user normally works in the finance department and has never requested a service ticket for the SQL service before. The analyst wants to determine if this activity is a precursor to a Kerberoasting attack. Which Cortex XDR data source would provide the most direct evidence of the service ticket encryption type and the requested Service Principal Name (SPN)?

A Cortex XDR analyst receives an alert for 'Suspicious LDAP Query' from a workstation. The query targeted the 'adminCount' attribute on multiple user objects. The analyst suspects an attacker is using AD reconnaissance to find privileged accounts. Which Cortex XDR feature should the analyst use to quickly visualize the scope of this reconnaissance and identify other affected hosts?