Detection And Reporting

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

An analyst writes an XQL query to aggregate alert counts by severity and action, but the query returns a parsing syntax error. dataset = xdr_data | filter causality_actor_process_image_name != null | comp count() by causality_actor_process_image_name What is the correct XQL syntax correction needed to successfully execute this aggregation?

A security engineer is investigating a potential lateral movement technique using WMI. The engineer wants to query the XDR backend using XQL (XDR Query Language) to search for process executions spawned by wmic.exe across all endpoints. Which XQL dataset should the query target?

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

An organization uses Cortex XDR to ingest cloud audit logs (such as AWS CloudTrail) alongside endpoint telemetry. An analyst wants to write an XQL query to search for AWS console login failures across the `aws_cloudtrail_raw` dataset. Which XQL structure properly targets cloud logs and filters for failed logins?

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

An administrator wants to create a new BIOC rule to detect suspicious process execution in Cortex XDR. Which menu path should the administrator navigate to in the Cortex XDR console?

An administrator wants to ensure high availability and proper auditing of user activities within the Cortex XDR management console. Which THREE administrative auditing features are available? (Choose three)

An administrator is designing a custom Alert-based BIOC rule in Cortex XDR. The requirement is to trigger an alert only when three distinct failed login events occur within a 5-minute window from the same source IP address. How should the aggregation and time window be configured?

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

When creating a widget for a custom dashboard in Cortex XDR, an analyst wants to display a visual trend of total alert counts categorized by severity over the last 30 days. Which data source and visualization type are most appropriate?

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)