XDR-Analyst Alert Lifecycle And Incident Correlation — 25 Questions

Question 1

An organization's security operations center (SOC) wants to adjust how Cortex XDR calculates incident severity scores based on specific asset criticality tags. Where should the administrator configure this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident View scoring configuration and severity weights. Cortex XDR calculates incident severity using configurable scoring rules and severity weights, which administrators can adjust in the Incident View scoring configuration. Asset criticality tags feed into these weights so that incidents involving critical assets score higher. This is the correct location to customize severity behavior based on asset criticality.

Answer

Featured fields display mapper

Answer

Data stitching engine properties

Answer

Raw alert priority override settings

Question 2

An analyst needs to customize the Incident View columns to display specific custom IOC tags prominently next to the incident name. Which configuration area in Cortex XDR supports this?

Accepted Answer

Featured fields customization. Featured fields in Cortex XDR define which normalized attributes are extracted from alerts and displayed in the incident view, including custom IOC tags. Customizing featured fields is the supported way to surface specific tags next to the incident name in the Incident View columns.

Answer

Alert exclusion rules

Answer

Data stitching parameters

Answer

Incident scoring profile

Question 3

An administrator wants to ensure that specific critical servers always generate incidents with elevated scores regardless of the automated ML score. Where can this policy be adjusted?

Accepted Answer

Data stitching rule configuration. Asset-based scoring overrides or scoring profiles in Cortex XDR allow administrators to boost incident severity based on asset criticality groups.

Answer

Alert starring policy manager

Answer

Featured fields definition menu

Question 4

Which TWO features assist an analyst in prioritizing which incidents to investigate first within the Cortex XDR console? (Choose two)

Accepted Answer

Incident Starring indicators. Option A, Incident Starring indicators, is correct because starring incidents in the Cortex XDR console lets an analyst manually flag and elevate specific incidents so they surface at the top of the incident list, directly assisting with prioritization. Option D, Incident Score / Severity ranking, is correct because Cortex XDR assigns each incident a calculated score/severity based on factors such as the number and type of triggered alerts, allowing analysts to sort and triage the highest-risk incidents first. The unmarked options do not belong: data stitching status logs (B) relate to how Cortex XDR correlates and stitches together endpoint data into incidents rather than ranking them, agent version compliance meters (C) track endpoint agent health/version status and have no bearing on incident priority, and featured fields display order (E) merely controls how columns or fields are arranged in the UI, not how incidents are prioritized.

Answer

Data stitching status logs

Answer

Agent version compliance meters

Answer

Featured fields display order

Question 5

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

Accepted Answer

Assign assets to high criticality groups. Option D is correct because assigning assets to high criticality groups raises their asset criticality value, which the incident scoring engine factors into the overall incident score, so incidents touching those assets are prioritized higher. Option E is correct because scoring profiles let administrators customize how severity weights and risk factors are combined, allowing a boost to incident severity weights so high-value assets produce higher scores. The other options do not tune scoring: automatic starring (A) only flags alerts for analyst attention and does not change the computed score, the global data stitching window (B) affects how events are correlated into incidents rather than their score, and featured fields (C) are a display customization that surfaces asset scores without altering scoring logic.

Answer

Enable automatic starring for all alerts on those assets

Answer

Adjust the global data stitching window

Answer

Create featured fields to display asset scores

Question 6

Which THREE configuration settings or components are directly involved in managing raw alerts before they become full incidents? (Choose three)

Accepted Answer

Detector and BIOC tuning parameters. Raw alerts are managed before incident creation using alert exclusion rules, detector tuning parameters, and BIOC/analytics configurations.

Answer

Featured fields UI grid mapper

Answer

Alert exclusion and exception rules

Answer

Analyst incident starring bookmarks

Question 7

A security analyst wants to adjust how Cortex XDR calculates incident severity to ensure that incidents involving domain controllers receive higher priority scores. Where should the analyst configure custom weights or scoring logic for incidents?

Accepted Answer

Under Settings > Configurations > Incident View > Incident Scoring. Incident scoring in Cortex XDR is governed by a configurable scoring model that assigns weights to alert categories, threat types, and asset criticality. The custom weights and scoring logic are exposed under Settings > Configurations > Incident View > Incident Scoring, where analysts can boost or reduce the contribution of specific factors (such as whether a domain controller is involved) to the final incident score. This is the only location in the console that exposes the scoring weight matrix used by the correlation engine.

Answer

Under Endpoint Security > Settings > Profiles > Malware > Severity Adjustment

Answer

Under Response > Action Center > Scoring Policy

Answer

Under Correlation Rules > Custom BIOC > Severity Tab

Question 8

During an investigation of an advanced persistent threat, an analyst wants to customize the Incident View layout to ensure that custom fields populated via parsed log ingestion are prominently displayed at the top of every incident summary. How should the analyst achieve this?

Accepted Answer

By modifying the Incident Layout via Settings > Configurations > Incident View > Featured Fields. The Incident View layout in Cortex XDR is customizable through Settings > Configurations > Incident View > Featured Fields. This interface allows analysts to select which fields—including custom fields populated by parsed logs—appear prominently at the top of every incident summary. By adding the custom fields to the Featured Fields list, they are displayed in the incident header for quick visibility. This is the only supported method to alter the incident summary layout without backend modifications.

Answer

By creating a custom BIOC rule with output variables mapped to incident tags

Answer

By exporting the incident JSON schema and modifying the UI template mapping

Answer

By editing the Incident Scoring configuration file via the CLI

Question 9

An analyst is reviewing the Incidents page in Cortex XDR and wants to quickly highlight a critical ransomware incident so that the shift supervisor can review it immediately without changing its status. Which feature should the analyst use?

Accepted Answer

Alert starring. Alert starring is the Cortex XDR feature that lets an analyst flag a specific alert for immediate attention without changing the incident's status, severity, or assignment. Starring surfaces the alert prominently (e.g., in filtered views and dashboards) so the shift supervisor can spot it quickly, which matches the requirement exactly.

Answer

Severity override

Answer

Incident assignment

Answer

Featured fields configuration

Question 10

During the alert-to-incident lifecycle in Cortex XDR, an alert is generated by an endpoint agent, evaluated by analytics, and subsequently combined into an existing incident. What status does the newly added alert assume upon joining the incident?

Accepted Answer

The alert automatically adopts the status of the parent incident (e.g., Under Investigation or Resolved).. When new alerts are added to an existing incident via correlation, they inherit the lifecycle context of the parent incident while retaining their individual alert states.

Answer

The alert status changes permanently to 'False Positive'.

Answer

The alert is dropped from the database due to duplicate correlation.

Answer

The alert is placed in 'Quarantine' status pending manual review.

Question 11

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that all executed the same malicious PowerShell script within a 10-minute window. The analyst wants to determine whether these alerts were automatically correlated into one incident by the stitching engine or manually grouped by a previous analyst. Where should the analyst look to confirm the correlation method?

Accepted Answer

In the Incident View, examine the 'Incident Details' pane which includes a 'Creation Type' field indicating whether the incident was auto-created or manually created.. The Incident Details pane in Cortex XDR contains a 'Creation Type' field that clearly indicates whether an incident was automatically created by the correlation engine or manually created by an analyst. This field is the authoritative source for determining the correlation method, making it the correct choice.

Answer

In the Incident View, open the 'Alerts' tab and review the 'Correlation Rule' column that identifies the specific rule or manual action that grouped the alerts.

Answer

In the Incident View, check the 'Incident Sources' field which lists whether the incident was created by automatic correlation or manual grouping.

Answer

In the Incident View, check the 'History' tab which logs all actions taken on the incident, including automatic stitching events and manual groupings.

Question 12

An analyst wants to reduce noise by ensuring that alerts from a known benign administrative tool are automatically excluded from future incidents. Which Cortex XDR feature should the analyst use?

Accepted Answer

Exception policy. Exception policies in Cortex XDR are designed to suppress alerts based on specific criteria, such as process name, command line, or user. By creating an exception for the benign administrative tool, the analyst can prevent future alerts from that tool from being generated or included in incidents. This effectively reduces noise and allows focus on genuine threats.

Answer

BIOC exception

Answer

Alert exclusion rule

Answer

Incident grouping rule

Question 13

An XDR analyst notices that a Cortex XDR incident contains alerts from three different endpoints, all involving the same file hash but with no apparent network connections between them. The analyst suspects the alerts are related but wants to confirm if they are part of a single attack campaign. Which Cortex XDR capability should the analyst use to correlate these alerts across endpoints?

Accepted Answer

XQL Query with join across endpoints. XQL enables deep, custom correlation across disparate data sources, including endpoint telemetry from multiple endpoints. By querying for the specific file hash and associated process activities, the analyst can uncover links that automatic stitching might miss, thereby confirming whether the alerts are part of a coordinated attack.

Answer

Threat Intelligence Management

Answer

Incident Response Actions

Answer

Incident Grouping by Alert Similarity

Question 14

An analyst is investigating a Cortex XDR incident that contains alerts from multiple endpoints. The analyst wants to see the chronological sequence of all alerts across the entire incident to understand the attack progression. Where in the Cortex XDR management console can the analyst view this unified, sorted list of alerts for the incident?

Accepted Answer

Incident View > Alerts tab. The Alerts tab in the Incident View is the central place where all alerts contributing to an incident are listed, each with a timestamp. This unified view enables analysts to see the exact order of events across multiple endpoints, which is essential for reconstructing the attack timeline and understanding how the adversary moved through the environment.

Answer

Endpoint Investigation > Timeline

Answer

Incident View > Causality Chain

Answer

Incident View > Alert Timeline

Question 15

An analyst is tuning Cortex XDR to reduce false positives from a custom BIOC rule that generates many alerts. The analyst wants to suppress alerts only when specific conditions are met, without disabling the rule entirely. Which two actions can the analyst take? (Choose two.)

Accepted Answer

Create an exception policy that matches the BIOC rule name and the specific conditions.. To suppress false positives from a custom BIOC rule without disabling it, the analyst can either create an exception policy that matches the rule and specific conditions, or modify the rule itself to add filter conditions. Both approaches allow the rule to continue detecting true positives while ignoring known benign activity. Disabling or duplicating the rule does not achieve targeted suppression.

Answer

Create a new BIOC rule that duplicates the logic but with additional filters.

Answer

Set the BIOC rule to 'Audit' mode instead of 'Block' mode.

Answer

Disable the BIOC rule and rely on other detections.

Question 16

A Cortex XDR incident is automatically created when multiple alerts are stitched together. The analyst wants to see the exact sequence of events that led to the incident, including the first alert and subsequent related alerts. Which section of the Incident view provides this chronological ordering?

Accepted Answer

Incident Timeline. The Incident Timeline is the dedicated view that orders all alerts and events chronologically, making it the correct choice for understanding the sequence of events that led to the incident. It helps analysts reconstruct the attack timeline and identify the initial vector.

Answer

Alert Grid

Answer

Incident Summary

Answer

Causality Chain

Question 17

An analyst is reviewing a Cortex XDR incident that contains several alerts. They want to add a note to one specific alert within the incident, indicating that it has been reviewed and deemed benign. Where can the analyst add this note so that it is associated with that alert rather than the entire incident?

Accepted Answer

By opening the alert's details from the incident's Alerts tab and using the 'Add Note' option in the alert's context menu.. Cortex XDR allows analysts to add notes directly to individual alerts within an incident. This is done by accessing the alert's context menu from the Alerts tab of the incident. Notes added this way are stored with the alert and are visible in the alert's details, ensuring that the annotation is tied to the specific alert rather than the incident as a whole.

Answer

By editing the alert's raw data in the Alert View and adding a comment field.

Answer

In the incident's Notes tab, by creating a new note and linking it to the alert ID.

Answer

By using the 'Add Tag' function on the incident and creating a tag with the alert ID and note text.

Question 18

An analyst is reviewing a Cortex XDR incident that was created by stitching together multiple alerts. The analyst wants to manually add a related alert from a different endpoint to the existing incident to keep all related activity together. Which two actions are possible in Cortex XDR to achieve this? (Choose two.)

Accepted Answer

Use the 'Add to Incident' action from the Alerts page.. The 'Add to Incident' action on the Alerts page allows direct manual association of alerts with an existing incident. Additionally, if the alert resides in another incident, merging incidents consolidates them. Both methods enable analysts to manually group related alerts, ensuring comprehensive incident context.

Answer

Modify the incident's stitching rules to include the alert.

Answer

Create a custom BIOC rule to trigger the alert into the incident.

Answer

Drag and drop the alert from the Alerts page onto the incident in the Incidents page.

Question 19

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Accepted Answer

Incident starring. Incident starring in Cortex XDR is a manual flag that analysts apply to specific incidents to mark them as noteworthy — for example, for executive visibility or follow-up. Starred incidents can be filtered and surfaced in dashboards, making them easy to track. This is the intended feature for flagging individual incidents without altering their severity or correlation logic.

Answer

Incident scoring threshold override

Answer

Data stitching rule assignment

Answer

Featured fields configuration

Question 20

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as separate incidents even though the IP and user match. The most likely cause is therefore that the time delta exceeds the stitching window.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs