Detection And Reporting

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

When creating a widget for a custom dashboard in Cortex XDR, an analyst wants to display a visual trend of total alert counts categorized by severity over the last 30 days. Which data source and visualization type are most appropriate?

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)

A Cortex XDR administrator needs a recurring report that shows the top ten MITRE ATT&CK techniques observed across all incidents in the last seven days, broken down by severity. The report must be generated automatically every Monday at 06:00 and emailed to the security leadership team. Which Cortex XDR capability should the administrator configure to meet these requirements?

A Cortex XDR engineer needs to build a recurring report that summarizes which MITRE ATT&CK techniques were observed across all incidents from the previous week, broken down by technique ID. The engineer wants the output to be generated automatically every Monday at 08:00 and emailed to the security leadership team. Which Cortex XDR capability should the engineer configure to meet these requirements?

An XDR engineer needs to schedule a recurring report that summarizes the count of alerts by MITRE ATT&CK tactic for the previous seven days, and deliver it as a CSV file every Monday at 08:00 to a distribution list. Which Cortex XDR feature should the engineer use to configure this?

During an investigation, a SOC analyst needs to determine which user account was associated with a specific process execution that triggered a Cortex XDR alert. The analyst has the Causality ID from the alert. Which Cortex XDR feature or query approach should the analyst use to identify the responsible user?

An analyst configures a scheduled report in Cortex XDR to summarize alert volumes per endpoint group every Monday. After the first run, the recipient inboxes show the report was generated but the attached data only covers the previous 24 hours instead of the entire preceding week. Which configuration element most likely caused this truncated reporting window?

An engineer is tuning detection coverage in Cortex XDR and wants to confirm whether a specific built-in Analytics BIOC is currently enabled, which MITRE ATT&CK technique it maps to, and whether it has generated any alerts in the past 24 hours. Which approach most directly provides all three pieces of information in one place?

A Cortex XDR administrator wants to create a custom BIOC rule that detects when a process creates a scheduled task using schtasks.exe with a specific suspicious argument pattern. The rule must trigger only when the parent process is NOT explorer.exe. Which BIOC rule configuration achieves this?

An XDR engineer is tuning the noise generated by a custom BIOC rule that fires on process executions containing the string 'powershell'. The engineer wants to suppress alerts only when the parent process is a known software deployment agent and the command line also contains 'Invoke-WebRequest'. Which mechanism should be used to implement this narrowly scoped exception without disabling the rule?

A Cortex XDR engineer needs to reduce alert fatigue caused by a noisy built-in Analytics BIOC. Rather than disabling the rule entirely, the security team wants to keep the detection but suppress matching alerts whenever the triggering process is a known signed internal IT automation binary. Which action should the engineer configure in Cortex XDR?

A detection engineer needs a Cortex XDR alert that fires only when a process writes a suspicious registry Run key and, within the same causality chain, subsequently spawns a script interpreter. The engineer wants the correlation to consider parent-child lineage rather than two unrelated events sharing an endpoint. Which mechanism should be used to express this lineage-aware condition?

A security analyst receives a Cortex XDR alert indicating a possible credential-dumping attempt on a finance workstation. The analyst wants to preserve volatile evidence and prevent the threat from spreading to other hosts while still allowing the incident to be investigated. Which Cortex XDR action should the analyst take on the affected endpoint?

A security analyst wants to review all alerts that were generated on a specific endpoint over the past 30 days and see which ones were already resolved versus still open. Which Cortex XDR view should the analyst open to accomplish this?

An analyst builds a custom dashboard widget in Cortex XDR that shows the count of alerts grouped by MITRE ATT&CK technique. The widget works, but the team also wants a second widget that shows the same alert counts split by the assigned alert owner so managers can track workload. The analyst wants to reuse the existing query with minimal changes. Which adjustment should the analyst make to the widget's XQL query?

A security operations team wants Cortex XDR to push high-severity alerts into their existing ticketing platform automatically, without an analyst manually exporting each incident. Which TWO built-in integration capabilities allow Cortex XDR to deliver alerts to an external system? (Choose two.)

A Cortex XDR engineer is asked to reduce alert fatigue from a built-in Analytics BIOC that fires on legitimate administrative activity in the environment, while preserving detection of the malicious behavior the rule targets. The engineer must keep the rule active and avoid weakening coverage for genuinely malicious activity. Which TWO actions should the engineer take? (Choose two.)

A Cortex XDR engineer is configuring the alert notification path so that high-severity incidents reach the on-call SOC analyst quickly. The team wants notifications delivered to an external collaboration platform and also wants an automated action to run when the alert fires. Which TWO Cortex XDR capabilities should the engineer configure to meet these requirements? (Choose two.)

A junior analyst needs a quick count of how many alerts each severity produced over the last seven days to prepare a management summary. Which Cortex XDR capability is the most direct way to obtain this aggregated view without writing complex query logic?

An engineer is tuning a custom BIOC rule that triggers on suspicious command-line patterns. During a red-team exercise the rule failed to fire even though the malicious command was executed. Review shows the rule matched on a process image name that the attacker replaced with a renamed copy of the same binary. Which adjustment best restores detection while limiting false positives?

A security analyst is reviewing an incident in Cortex XDR and wants to understand the sequence of events that led to a detection, including which process launched which child process and how the activity unfolded over time. Which Cortex XDR feature should the analyst use to view this ordered chain of related events?

A Cortex XDR engineer is tuning detection coverage and wants to know which MITRE ATT&CK techniques the organization's current endpoint policies and analytics are actually detecting, so gaps can be prioritized. Which Cortex XDR capability should the engineer use to map existing detections to ATT&CK techniques and visualize coverage?

An XDR engineer is investigating an incident where an alert shows a suspicious scheduled task created on a server. The engineer wants to determine whether the same process that created the task also initiated outbound network connections within the same causality chain. Which Cortex XDR capability should the engineer use to trace this relationship?

An XDR engineer needs to create a scheduled report in Cortex XDR that delivers a daily PDF summary of all critical alerts to the security leadership team. The report must include a breakdown of alerts by severity and a trend chart over the last 7 days. Which component of Cortex XDR should the engineer use to configure this?

A Cortex XDR engineer is investigating a series of alerts related to a suspicious PowerShell script execution. The engineer wants to determine if the same script has been executed on other endpoints in the environment over the past 60 days. Which Cortex XDR capability should the engineer use to efficiently search across all endpoints for this specific script hash?

An XDR engineer is building a scheduled query in Cortex XDR to detect unusual authentication patterns. The engineer needs the query to run every 15 minutes and only surface results when the count of failed logons for a user exceeds 10 within the window. Which configuration element in the scheduled query definition accomplishes this?

An XDR engineer needs to create a Cortex XDR report that shows the number of alerts per severity level for the last 7 days. The report should be generated automatically every Monday at 8:00 AM and emailed to the security team. Which component in Cortex XDR should the engineer use to configure this?

An XDR engineer is analyzing a Cortex XDR incident and wants to determine the root cause of a process that was flagged as malicious. The engineer needs to see the full process execution chain, including parent and child processes, with command-line arguments and user context. Which Cortex XDR feature should the engineer use?

An XDR engineer is configuring a Cortex XDR scheduled query to detect potential ransomware activity. The query must identify processes that create a high number of file write operations to unique file extensions within a short time window. Which TWO XQL stages are essential to achieve this detection? (Choose two.)