XDR-Analyst › Evidence Review And Response Actions

Evidence Review And Response Actions Practice Questions

This domain covers how analysts review collected evidence in Cortex XDR and take response actions: reading the Incident View, updating incident status, scoping exceptions to suppress false positives, and using endpoint evidence such as scheduled tasks and local access artifacts to confirm compromise and drive remediation.