XDR-Analyst Alert Lifecycle And Incident Correlation — 15 Questions

Question 1

An administrator wants to ensure that specific critical servers always generate incidents with elevated scores regardless of the automated ML score. Where can this policy be adjusted?

Accepted Answer

Data stitching rule configuration. Asset-based scoring overrides or scoring profiles in Cortex XDR allow administrators to boost incident severity based on asset criticality groups.

Answer

Alert starring policy manager

Answer

Featured fields definition menu

Question 2

Which THREE configuration settings or components are directly involved in managing raw alerts before they become full incidents? (Choose three)

Accepted Answer

Detector and BIOC tuning parameters. Raw alerts are managed before incident creation using alert exclusion rules, detector tuning parameters, and BIOC/analytics configurations.

Answer

Featured fields UI grid mapper

Answer

Alert exclusion and exception rules

Answer

Analyst incident starring bookmarks

Question 3

An organization's security operations center (SOC) wants to adjust how Cortex XDR calculates incident severity scores based on specific asset criticality tags. Where should the administrator configure this behavior?

Accepted Answer

Incident View scoring configuration and severity weights. Incident scoring can be customized using scoring rules or profiles that factor in asset criticality to ensure high-value assets elevate incident severity appropriately.

Answer

Featured fields display mapper

Answer

Data stitching engine properties

Answer

Raw alert priority override settings

Question 4

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Accepted Answer

Incident starring. Alert starring and incident starring allow analysts to bookmark or star specific items to highlight them for immediate attention and follow-up.

Answer

Incident scoring threshold override

Answer

Data stitching rule assignment

Answer

Featured fields configuration

Question 5

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Data stitching relies on consistent identity and endpoint mapping. If the time window between events exceeds the stitching threshold or identifiers like MAC/hostname do not match correctly, stitching may fail.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 6

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

Accepted Answer

Immediately upon correlation and grouping by the Incident Engine. When a raw alert triggers, Cortex XDR evaluates it against existing open incidents or creates a new incident based on correlation and stitching logic, moving it into the Incident View.

Answer

Only after an analyst manually assigns a severity score

Answer

Once featured fields are populated for the data source

Answer

When the alert is starred by a tier-2 analyst

Question 7

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Accepted Answer

Alerts View filter and search capabilities. Global search or filtering within the Alerts View allows analysts to query specific IOCs, IPs, or hashes across all incidents and alerts.

Answer

Incident scoring threshold filter

Answer

Featured fields sorting

Answer

Data stitching status toggle

Question 8

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Accepted Answer

Create an alert exclusion or exception rule. Administrators can create alert tuning or exclusion rules to filter out known benign activities so they do not generate unnecessary raw alerts or incidents.

Answer

Manually star all related alerts

Answer

Increase the data stitching window

Answer

Modify featured fields to hide script alerts

Question 9

An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?

Accepted Answer

Cortex XDR correlation rules and analytics grouping. Cortex XDR uses Analytics and Analytics Profiling, along with correlation rules, to automatically group related alerts into a single incident based on indicators of compromise and shared telemetry.

Answer

Syslog forwarding profile filters

Answer

Manual aggregation by the assigned security analyst

Answer

The endpoint agent local threshold configuration

Question 10

An analyst needs to customize the Incident View columns to display specific custom IOC tags prominently next to the incident name. Which configuration area in Cortex XDR supports this?

Accepted Answer

Featured fields customization. Featured fields allow administrators to customize which fields are prominently displayed within the Incident View and Alert View grids.

Answer

Alert exclusion rules

Answer

Data stitching parameters

Answer

Incident scoring profile

Question 11

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

Accepted Answer

Cortex XDR Analyst role. Incident management actions such as status changes and assignment require appropriate analyst or administrator roles with incident handling permissions.

Answer

Data stitching configuration role

Answer

Syslog forwarding administrator

Answer

Collector installation role

Question 12

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

Accepted Answer

High severity incident. Cortex XDR uses standard severity levels (Low, Medium, High, Critical) represented by color-coded badges, where orange typically denotes High severity.

Answer

Critical severity incident requiring immediate containment

Answer

Low priority false positive

Answer

Informational event requiring no action

Question 13

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Accepted Answer

It traces the parent-child process relationship and telemetry leading to the alert. The Causality Chain visualizes the chronological sequence of processes, network connections, and file modifications that led to an alert, helping trace the origin of the incident.

Answer

It automatically recalculates the incident score based on user activity

Answer

It stitches network logs with endpoint logs using IP subnet masks

Answer

It filters featured fields to highlight malicious hashes

Question 14

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Accepted Answer

Cross-data-source data stitching. Data stitching correlates logs from endpoints, networks, and cloud sources using common identifiers like IP addresses, usernames, and timestamps into a cohesive incident.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 15

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Accepted Answer

Mark the specific raw alert as a false positive or dismiss it within the incident view. Analysts can manage individual alerts within an incident, suppressing or tuning specific detectors or marking individual alerts as false positives without discarding the entire incident.

Answer

Change the incident score to zero to hide all alerts

Answer

Delete the entire incident and recreate it manually

Answer

Apply an alert starring filter to exclude the false positive