XDR-Analyst Alert Lifecycle And Incident Correlation — All Questions With Answers

Question 1mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An organization's security operations center (SOC) wants to adjust how Cortex XDR calculates incident severity scores based on specific asset criticality tags. Where should the administrator configure this behavior?

Question 2easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst needs to customize the Incident View columns to display specific custom IOC tags prominently next to the incident name. Which configuration area in Cortex XDR supports this?

Question 3mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator wants to ensure that specific critical servers always generate incidents with elevated scores regardless of the automated ML score. Where can this policy be adjusted?

Question 4mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO features assist an analyst in prioritizing which incidents to investigate first within the Cortex XDR console? (Choose two)

Question 5mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

Question 6hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which THREE configuration settings or components are directly involved in managing raw alerts before they become full incidents? (Choose three)

Question 7mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A security analyst wants to adjust how Cortex XDR calculates incident severity to ensure that incidents involving domain controllers receive higher priority scores. Where should the analyst configure custom weights or scoring logic for incidents?

Question 8hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During an investigation of an advanced persistent threat, an analyst wants to customize the Incident View layout to ensure that custom fields populated via parsed log ingestion are prominently displayed at the top of every incident summary. How should the analyst achieve this?

Question 9mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing the Incidents page in Cortex XDR and wants to quickly highlight a critical ransomware incident so that the shift supervisor can review it immediately without changing its status. Which feature should the analyst use?

Question 10mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During the alert-to-incident lifecycle in Cortex XDR, an alert is generated by an endpoint agent, evaluated by analytics, and subsequently combined into an existing incident. What status does the newly added alert assume upon joining the incident?

Question 11mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that all executed the same malicious PowerShell script within a 10-minute window. The analyst wants to determine whether these alerts were automatically correlated into one incident by the stitching engine or manually grouped by a previous analyst. Where should the analyst look to confirm the correlation method?

Question 12easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to reduce noise by ensuring that alerts from a known benign administrative tool are automatically excluded from future incidents. Which Cortex XDR feature should the analyst use?

Question 13hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An XDR analyst notices that a Cortex XDR incident contains alerts from three different endpoints, all involving the same file hash but with no apparent network connections between them. The analyst suspects the alerts are related but wants to confirm if they are part of a single attack campaign. Which Cortex XDR capability should the analyst use to correlate these alerts across endpoints?

Question 14mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains alerts from multiple endpoints. The analyst wants to see the chronological sequence of all alerts across the entire incident to understand the attack progression. Where in the Cortex XDR management console can the analyst view this unified, sorted list of alerts for the incident?

Question 15hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is tuning Cortex XDR to reduce false positives from a custom BIOC rule that generates many alerts. The analyst wants to suppress alerts only when specific conditions are met, without disabling the rule entirely. Which two actions can the analyst take? (Choose two.)

Question 16easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A Cortex XDR incident is automatically created when multiple alerts are stitched together. The analyst wants to see the exact sequence of events that led to the incident, including the first alert and subsequent related alerts. Which section of the Incident view provides this chronological ordering?

Question 17mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that contains several alerts. They want to add a note to one specific alert within the incident, indicating that it has been reviewed and deemed benign. Where can the analyst add this note so that it is associated with that alert rather than the entire incident?

Question 18mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that was created by stitching together multiple alerts. The analyst wants to manually add a related alert from a different endpoint to the existing incident to keep all related activity together. Which two actions are possible in Cortex XDR to achieve this? (Choose two.)

Question 19mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Question 20hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Question 21hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

Question 22easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Question 23mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Question 24easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?

Question 25easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

Question 26easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

Question 27hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Question 28mediummultiple choice

Read the full network assurance explanation →

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Question 29hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Question 30hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

Question 31easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What is the primary purpose of starring an alert within an incident details pane?

Question 32mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

Question 33hardmultiple choice

Read the full NAT/PAT explanation →

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

Question 34easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Question 35mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

Question 36hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

Question 37easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What action should an analyst take in Cortex XDR when an incident investigation is fully complete and all remediation steps have been verified?

Question 38mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Question 39hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

Question 40easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

Question 41mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

Question 42easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Question 43mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Question 44hardmultiple choice

Read the full network assurance explanation →

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

Question 45easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

Question 46hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

Question 47hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

Question 48mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

Question 49easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

Question 50mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Question 51hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

Question 52easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

Question 53mediummultiple choice

Review the full routing breakdown →

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

Question 54mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

Question 55hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

During data stitching across endpoints and networks, what THREE core attributes does Cortex XDR typically leverage to correlate disparate logs into a single incident? (Choose three)

Question 56hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Question 57mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Question 58hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Question 59mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Question 60hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Question 61mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Question 62hardmulti select

Read the full network assurance explanation →

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Question 63hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Question 64hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Question 65mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Question 66mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

Question 67hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

Question 68easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Question 69easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Question 70hardmultiple choice

Read the full network assurance explanation →

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

Question 71hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Question 72mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An incident responder is investigating a complex incident in Cortex XDR and needs to examine the raw alert-to-incident lifecycle and data stitching relationships. Which THREE components or views in the Cortex XDR console should the responder utilize to thoroughly analyze this data? (Choose three)

Question 73hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Question 74mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

Question 75hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

Question 76mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Question 77mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains several alerts from different endpoints. The analyst wants to quickly identify the root cause alert that initiated the incident and understand the sequence of events. Which feature in the incident details view provides a chronological timeline of all related alerts and activities?

Question 78easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A security analyst receives a Cortex XDR incident that was automatically created from multiple alerts. The analyst wants to assign the incident to a specific team member for further investigation. Which action should the analyst take?

Question 79easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A Cortex XDR analyst receives a critical incident for an endpoint that was quarantined by the organization months ago but is still generating new alerts. The analyst wants to quickly verify whether the endpoint has had any recent network activity that could indicate the alerts are from a live but unmanaged device. Which Cortex XDR feature should the analyst use to view the latest network connections associated with that endpoint?

Question 80hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

Question 81hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Question 82mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that was created by the correlation engine. The analyst wants to understand why certain alerts were grouped together. Which two factors does the Cortex XDR correlation engine primarily use to stitch alerts into a single incident? (Choose two.)

Question 83mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that are not related to the same attack. The analyst wants to manually split these unrelated alerts into separate incidents to improve tracking. Which action should the analyst take within the incident view?

Question 84mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During incident triage, an analyst notices that a Cortex XDR incident contains alerts from both a Windows endpoint and a Linux server. The analyst wants to see the specific MITRE ATT&CK techniques associated with each alert to understand the adversary's tactics. Where can the analyst find this information?

Question 85hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

Question 86hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is examining a Cortex XDR incident that includes a high-severity alert for a suspicious process execution. The analyst wants to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

Question 87hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident where the automatic correlation engine grouped alerts based on a shared causality ID. The analyst discovers that one alert in the incident actually belongs to a different attack on the same endpoint. What should the analyst do to correct the incident grouping?

Question 88mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst wants to see a visual representation of how the alerts are related over time to better understand the attack progression. Which Cortex XDR feature should the analyst use?

Question 89mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst notices that a Cortex XDR incident contains alerts from two different endpoints that appear to be part of the same attack campaign. The analyst wants to confirm that the incidents are linked by a common threat actor. Which Cortex XDR feature provides a graphical representation of the relationships between alerts, endpoints, and indicators of compromise (IOCs) to help identify such connections?

Question 90hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that includes both endpoint and network alerts. They notice that the incident's timeline shows a gap between a network alert indicating a suspicious outbound connection and a subsequent endpoint alert for process execution. The analyst suspects that the two alerts are related but were not stitched into the same incident. What is the most likely reason for the failure to correlate these alerts into a single incident?

Question 91hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

Question 92hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is triaging a Cortex XDR incident that contains a mix of high and low severity alerts. The analyst wants to quickly identify which alerts are most critical to address first. Which column in the Incident View's Alerts tab should the analyst sort by to prioritize alerts based on their potential impact?

Question 93easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst needs to quickly identify all incidents in Cortex XDR that are related to a specific MITRE ATT&CK technique, such as T1059 (Command and Scripting Interpreter). What is the most efficient way to find these incidents?

Question 94hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident where the same alert appears multiple times with different timestamps. The analyst wants to understand why the alert was duplicated. Which factor is most likely responsible for the duplicate alerts within the incident?

Question 95mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident and wants to identify all alerts within the incident that are mapped to the 'Execution' tactic in the MITRE ATT&CK framework. Which TWO methods can the analyst use to achieve this? (Choose two.)

Question 96mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that was automatically created from a high-severity alert. The analyst determines that the alert is a false positive and wants to ensure that future identical alerts do not create new incidents. What is the most appropriate action?

Question 97hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that contains multiple alerts from different endpoints. The analyst wants to identify the root cause and determine the scope of the attack. Which TWO actions should the analyst take to achieve this? (Choose two.)

Question 98easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident and wants to quickly see which alerts are associated with the incident and their current status. Where should the analyst look?

Question 1mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An organization's security operations center (SOC) wants to adjust how Cortex XDR calculates incident severity scores based on specific asset criticality tags. Where should the administrator configure this behavior?

Question 2easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst needs to customize the Incident View columns to display specific custom IOC tags prominently next to the incident name. Which configuration area in Cortex XDR supports this?

Question 3mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator wants to ensure that specific critical servers always generate incidents with elevated scores regardless of the automated ML score. Where can this policy be adjusted?

Question 4mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO features assist an analyst in prioritizing which incidents to investigate first within the Cortex XDR console? (Choose two)

Question 5mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

Question 6hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which THREE configuration settings or components are directly involved in managing raw alerts before they become full incidents? (Choose three)

Question 7mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A security analyst wants to adjust how Cortex XDR calculates incident severity to ensure that incidents involving domain controllers receive higher priority scores. Where should the analyst configure custom weights or scoring logic for incidents?

Question 8hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During an investigation of an advanced persistent threat, an analyst wants to customize the Incident View layout to ensure that custom fields populated via parsed log ingestion are prominently displayed at the top of every incident summary. How should the analyst achieve this?

Question 9mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing the Incidents page in Cortex XDR and wants to quickly highlight a critical ransomware incident so that the shift supervisor can review it immediately without changing its status. Which feature should the analyst use?

Question 10mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During the alert-to-incident lifecycle in Cortex XDR, an alert is generated by an endpoint agent, evaluated by analytics, and subsequently combined into an existing incident. What status does the newly added alert assume upon joining the incident?

Question 11mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that all executed the same malicious PowerShell script within a 10-minute window. The analyst wants to determine whether these alerts were automatically correlated into one incident by the stitching engine or manually grouped by a previous analyst. Where should the analyst look to confirm the correlation method?

Question 12easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to reduce noise by ensuring that alerts from a known benign administrative tool are automatically excluded from future incidents. Which Cortex XDR feature should the analyst use?

Question 13hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An XDR analyst notices that a Cortex XDR incident contains alerts from three different endpoints, all involving the same file hash but with no apparent network connections between them. The analyst suspects the alerts are related but wants to confirm if they are part of a single attack campaign. Which Cortex XDR capability should the analyst use to correlate these alerts across endpoints?

Question 14mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains alerts from multiple endpoints. The analyst wants to see the chronological sequence of all alerts across the entire incident to understand the attack progression. Where in the Cortex XDR management console can the analyst view this unified, sorted list of alerts for the incident?

Question 15hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is tuning Cortex XDR to reduce false positives from a custom BIOC rule that generates many alerts. The analyst wants to suppress alerts only when specific conditions are met, without disabling the rule entirely. Which two actions can the analyst take? (Choose two.)

Question 16easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A Cortex XDR incident is automatically created when multiple alerts are stitched together. The analyst wants to see the exact sequence of events that led to the incident, including the first alert and subsequent related alerts. Which section of the Incident view provides this chronological ordering?

Question 17mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that contains several alerts. They want to add a note to one specific alert within the incident, indicating that it has been reviewed and deemed benign. Where can the analyst add this note so that it is associated with that alert rather than the entire incident?

Question 18mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that was created by stitching together multiple alerts. The analyst wants to manually add a related alert from a different endpoint to the existing incident to keep all related activity together. Which two actions are possible in Cortex XDR to achieve this? (Choose two.)

Question 19mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Question 20hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Question 21hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

Question 22easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Question 23mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Question 24easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?

Question 25easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

Question 26easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

Question 27hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Question 28mediummultiple choice

Read the full network assurance explanation →

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Question 29hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Question 30hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

Question 31easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What is the primary purpose of starring an alert within an incident details pane?

Question 32mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

Question 33hardmultiple choice

Read the full NAT/PAT explanation →

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

Question 34easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Question 35mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

Question 36hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

Question 37easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What action should an analyst take in Cortex XDR when an incident investigation is fully complete and all remediation steps have been verified?

Question 38mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Question 39hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

Question 40easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

Question 41mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

Question 42easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Question 43mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Question 44hardmultiple choice

Read the full network assurance explanation →

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

Question 45easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

Question 46hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

Question 47hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

Question 48mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

Question 49easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

Question 50mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Question 51hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

Question 52easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

Question 53mediummultiple choice

Review the full routing breakdown →

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

Question 54mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

Question 55hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

During data stitching across endpoints and networks, what THREE core attributes does Cortex XDR typically leverage to correlate disparate logs into a single incident? (Choose three)

Question 56hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Question 57mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Question 58hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Question 59mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Question 60hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Question 61mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Question 62hardmulti select

Read the full network assurance explanation →

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Question 63hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Question 64hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Question 65mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Question 66mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

Question 67hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

Question 68easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Question 69easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Question 70hardmultiple choice

Read the full network assurance explanation →

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

Question 71hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Question 72mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An incident responder is investigating a complex incident in Cortex XDR and needs to examine the raw alert-to-incident lifecycle and data stitching relationships. Which THREE components or views in the Cortex XDR console should the responder utilize to thoroughly analyze this data? (Choose three)

Question 73hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Question 74mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

Question 75hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

Question 76mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Question 77mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that contains several alerts from different endpoints. The analyst wants to quickly identify the root cause alert that initiated the incident and understand the sequence of events. Which feature in the incident details view provides a chronological timeline of all related alerts and activities?

Question 78easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A security analyst receives a Cortex XDR incident that was automatically created from multiple alerts. The analyst wants to assign the incident to a specific team member for further investigation. Which action should the analyst take?

Question 79easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A Cortex XDR analyst receives a critical incident for an endpoint that was quarantined by the organization months ago but is still generating new alerts. The analyst wants to quickly verify whether the endpoint has had any recent network activity that could indicate the alerts are from a live but unmanaged device. Which Cortex XDR feature should the analyst use to view the latest network connections associated with that endpoint?

Question 80hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

Question 81hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Question 82mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that was created by the correlation engine. The analyst wants to understand why certain alerts were grouped together. Which two factors does the Cortex XDR correlation engine primarily use to stitch alerts into a single incident? (Choose two.)

Question 83mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that are not related to the same attack. The analyst wants to manually split these unrelated alerts into separate incidents to improve tracking. Which action should the analyst take within the incident view?

Question 84mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

During incident triage, an analyst notices that a Cortex XDR incident contains alerts from both a Windows endpoint and a Linux server. The analyst wants to see the specific MITRE ATT&CK techniques associated with each alert to understand the adversary's tactics. Where can the analyst find this information?

Question 85hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

Question 86hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is examining a Cortex XDR incident that includes a high-severity alert for a suspicious process execution. The analyst wants to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

Question 87hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident where the automatic correlation engine grouped alerts based on a shared causality ID. The analyst discovers that one alert in the incident actually belongs to a different attack on the same endpoint. What should the analyst do to correct the incident grouping?

Question 88mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst wants to see a visual representation of how the alerts are related over time to better understand the attack progression. Which Cortex XDR feature should the analyst use?

Question 89mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst notices that a Cortex XDR incident contains alerts from two different endpoints that appear to be part of the same attack campaign. The analyst wants to confirm that the incidents are linked by a common threat actor. Which Cortex XDR feature provides a graphical representation of the relationships between alerts, endpoints, and indicators of compromise (IOCs) to help identify such connections?

Question 90hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that includes both endpoint and network alerts. They notice that the incident's timeline shows a gap between a network alert indicating a suspicious outbound connection and a subsequent endpoint alert for process execution. The analyst suspects that the two alerts are related but were not stitched into the same incident. What is the most likely reason for the failure to correlate these alerts into a single incident?

Question 91hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

Question 92hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is triaging a Cortex XDR incident that contains a mix of high and low severity alerts. The analyst wants to quickly identify which alerts are most critical to address first. Which column in the Incident View's Alerts tab should the analyst sort by to prioritize alerts based on their potential impact?

Question 93easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst needs to quickly identify all incidents in Cortex XDR that are related to a specific MITRE ATT&CK technique, such as T1059 (Command and Scripting Interpreter). What is the most efficient way to find these incidents?

Question 94hardmultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident where the same alert appears multiple times with different timestamps. The analyst wants to understand why the alert was duplicated. Which factor is most likely responsible for the duplicate alerts within the incident?

Question 95mediummulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident and wants to identify all alerts within the incident that are mapped to the 'Execution' tactic in the MITRE ATT&CK framework. Which TWO methods can the analyst use to achieve this? (Choose two.)

Question 96mediummultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is investigating a Cortex XDR incident that was automatically created from a high-severity alert. The analyst determines that the alert is a false positive and wants to ensure that future identical alerts do not create new incidents. What is the most appropriate action?

Question 97hardmulti select

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident that contains multiple alerts from different endpoints. The analyst wants to identify the root cause and determine the scope of the attack. Which TWO actions should the analyst take to achieve this? (Choose two.)

Question 98easymultiple choice

Read the full Alert Lifecycle And Incident Correlation explanation →

An analyst is reviewing a Cortex XDR incident and wants to quickly see which alerts are associated with the incident and their current status. Where should the analyst look?