XDR-Engineer Detection And Reporting — 20 Questions

Question 1

An analyst writes an XQL query to aggregate alert counts by severity and action, but the query returns a parsing syntax error.

dataset = xdr_data
| filter causality_actor_process_image_name != null
| comp count() by causality_actor_process_image_name

What is the correct XQL syntax correction needed to successfully execute this aggregation?

Accepted Answer

Replace 'comp count()' with 'stats count()'. In XQL, the correct aggregation command keyword is `stats` (or `ion`), not `comp`. Therefore, `comp count()` must be replaced with `stats count()_as_count` or `stats count() by ...`.

Answer

Remove the causality filter entirely because null checks are unsupported in XQL.

Answer

Change 'xdr_data' to 'panw_alerts' and use 'aggregate' instead of 'comp'.

Answer

Replace 'filter' with 'where' and remove the dataset declaration.

Question 2

A security engineer is investigating a potential lateral movement technique using WMI. The engineer wants to query the XDR backend using XQL (XDR Query Language) to search for process executions spawned by wmic.exe across all endpoints. Which XQL dataset should the query target?

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and actor_process_image_path contains 'wmic.exe'. XQL queries targeting endpoint process executions should query the XDM dataset representing process events, specifically `xdr_data` with a filter on the dataset schema for process activity.

Answer

dataset = panw_analytics_alerts | filter alert_name = 'WMI Execution'

Answer

dataset = network_story | filter protocol = 'WMI'

Answer

dataset = endpoints_inventory | filter status = 'Active'

Question 3

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

Accepted Answer

dataset = xdr_data | filter username == 'TargetUser' and _time >= now() - 24h. Filtering the `xdr_data` dataset by the specific username and a time range (`emp_time` or timestamp filters) allows full behavioral reconstruction of user activity.

Answer

dataset = endpoints_inventory | filter owner == 'TargetUser'

Answer

dataset = panw_analytics_alerts | filter alert_id == 'TargetUser'

Answer

dataset = network_story | filter user_context == null

Question 4

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

Accepted Answer

Settings -> Configurations -> License Management / Hub. License utilization, data ingestion volumes, and storage statistics in Cortex XDR are managed and viewed via the License Management / Settings menus.

Answer

Host Insights -> Disk Utilization report

Answer

Incident Response -> Queue Statistics

Answer

Analytics -> BIOC Rule Health monitor

Question 5

An organization uses Cortex XDR to ingest cloud audit logs (such as AWS CloudTrail) alongside endpoint telemetry. An analyst wants to write an XQL query to search for AWS console login failures across the `aws_cloudtrail_raw` dataset. Which XQL structure properly targets cloud logs and filters for failed logins?

Accepted Answer

dataset = aws_cloudtrail_raw | filter eventName == 'ConsoleLogin' and responseElements contains 'Failure'. Cloud audit logs ingested into Cortex XDR land in provider-specific raw datasets such as `aws_cloudtrail_raw`. To find failed AWS console logins, you query that dataset and filter on `eventName == 'ConsoleLogin'` combined with a check that `responseElements` contains 'Failure' (the field CloudTrail populates on failed authentication). This targets the correct dataset and the correct CloudTrail fields.

Answer

dataset = panw_analytics_alerts | filter source == 'AWS'

Answer

dataset = xdr_data | filter cloud_event == 'AWS_LOGIN_FAIL'

Answer

dataset = endpoints_inventory | filter cloud_provider == 'AWS'

Question 6

An administrator wants to create a new BIOC rule to detect suspicious process execution in Cortex XDR. Which menu path should the administrator navigate to in the Cortex XDR console?

Accepted Answer

Incident Response > BIOC Rules. The correct path to create a new BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR is Incident Response > BIOC Rules. This section is specifically designed for defining behavioral detection logic that triggers alerts based on process, file, network, and registry activities. BIOC rules are a core part of Cortex XDR's behavioral analytics engine, allowing administrators to write custom detection rules using the Cortex XDR rule syntax. Navigating to this menu provides the interface to create, edit, and manage these rules, including setting the rule name, description, severity, and the actual behavioral condition.

Answer

XQL Search > Query Builder

Answer

Endpoints > Policy Rules

Answer

Data Collection > Log Stitching

Question 7

An administrator wants to ensure high availability and proper auditing of user activities within the Cortex XDR management console. Which THREE administrative auditing features are available? (Choose three)

Accepted Answer

Audit Log of administrator actions within the console. Option A is correct because Cortex XDR maintains an Audit Log that records administrator actions performed within the management console, such as configuration changes, policy edits, and other privileged operations, which directly supports the auditing requirement. Option D is correct because Cortex XDR supports SAML 2.0 SSO integration, and authentication events tied to that integration (logins, identity provider assertions, and related access activity) are auditable, helping trace who accessed the console and how. Option E is correct because user login session tracking records console sign-in and session activity, providing visibility into which administrators accessed the console and when, which is essential for proper auditing. Option B is not correct because endpoint hard disk SMART status monitoring is an endpoint health/telemetry capability, not an administrative auditing feature of the management console. Option C is not correct because automatic kernel debugging dump generation relates to endpoint crash diagnostics and troubleshooting, not to auditing administrator activity in the console.

Answer

Endpoint hard disk SMART status monitoring

Answer

Automatic kernel debugging dump generation

Question 8

An administrator is designing a custom Alert-based BIOC rule in Cortex XDR. The requirement is to trigger an alert only when three distinct failed login events occur within a 5-minute window from the same source IP address. How should the aggregation and time window be configured?

Accepted Answer

Set the threshold count to 3, group by source IP address, and set the time window to 5 minutes.. Alert-based BIOC rules support aggregation and grouping by specific fields with a sliding time window to detect threshold breaches.

Answer

Set the threshold count to 5, group by event ID, and set the time window to 3 minutes.

Answer

Configure a BIOC rule using a single event trigger with a recurrence limit set to 3.

Answer

Use XQL correlation rules instead, because BIOC rules cannot evaluate time-based thresholds.

Question 9

A Cortex XDR analyst is building a scheduled XQL query to hunt for suspicious PowerShell executions. The analyst wants the query to return the count of executions per endpoint, filtered to only endpoints where the count exceeds 5. Which XQL construction correctly applies the threshold filter to the aggregated results?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" | comp count() as exec_count by agent_hostname | filter exec_count > 5. Aggregating first and then filtering is the only correct order in XQL. The comp stage produces the exec_count field keyed by agent_hostname, and a subsequent filter stage can compare that aggregated field to the threshold. Any attempt to reference count() before comp, or to use non-XQL stage keywords like where or limit for numeric comparisons, fails to express the intended threshold logic.

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" | comp count() as exec_count by agent_hostname | limit exec_count > 5

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" and count() > 5 | comp count() as exec_count by agent_hostname

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" | comp count() as exec_count by agent_hostname | where exec_count > 5

Question 10

A Cortex XDR administrator needs to ensure that all alerts generated from a specific custom BIOC rule are automatically assigned to the 'Malware Analysis' team and tagged with 'HighPriority'. Which configuration should the administrator use?

Accepted Answer

In the BIOC rule settings, configure the 'Alert Assignment' to the 'Malware Analysis' team and add a tag 'HighPriority'.. Cortex XDR BIOC rules include native fields for alert assignment and tagging. By configuring the 'Alert Assignment' to the 'Malware Analysis' team and adding the 'HighPriority' tag within the rule, all alerts generated by that rule are automatically routed and labeled, fulfilling the requirement without external automation.

Answer

Use the Cortex XDR API to poll for new alerts and update their assignment and tags programmatically.

Answer

Configure a global alert exclusion rule that matches the BIOC rule name and applies the assignment and tag.

Answer

Create a playbook in Cortex XSOAR that assigns the alert and adds the tag when the BIOC rule triggers.

Question 11

An XDR engineer needs to produce a report that shows, for the past quarter, the top ten endpoints by number of high-severity alerts and the MITRE ATT&CK techniques most frequently associated with those alerts. The report must be generated on demand from live data. Which TWO Cortex XDR capabilities should the engineer use to build this report? (Choose two.)

Accepted Answer

Use the Widget Library to add a prebuilt 'Top Endpoints by Alert Count' widget to a custom dashboard for the quarter.. The Query Center with XQL provides the aggregation and filtering needed to compute top endpoints and MITRE technique frequencies from live alert data on demand. Custom dashboards with Widget Library components complement this by presenting the endpoint ranking visually and refreshing from live data. Together they satisfy the on-demand, live-data reporting requirement without external tooling or manual tagging.

Answer

Use the Cortex XDR API to pull raw alert JSON and process it in an external BI tool without any XQL or dashboard involvement.

Answer

Use the Reports module to schedule a quarterly PDF that summarizes alert counts grouped by endpoint.

Answer

Use the Incident Response view to manually tag each high-severity alert with the endpoint name and technique before exporting.

Question 12

An analyst is investigating a Cortex XDR incident and needs to determine the initial infection vector by examining the process execution chain. The analyst has the Causality ID of the alerting process. Which XQL query correctly retrieves the full chain of processes leading to the alerting process?

Accepted Answer

dataset = xdr_data | filter causality_id = "<ID>" | call get_causality_chain(causality_id) | fields actor_process_image_name, causality_id, parent_causality_id. To retrieve the full process chain from a Causality ID, Cortex XDR offers the `get_causality_chain` function in XQL. This function traverses the causality relationships and returns all related processes, including parents and children. The analyst can then examine the chain to find the initial process that started the sequence, identifying the infection vector.

Answer

dataset = xdr_data | filter causality_id = "" or parent_causality_id = "" | fields actor_process_image_name, causality_id, parent_causality_id

Answer

dataset = xdr_data | filter causality_id = "<ID>" | join (dataset = xdr_data | filter causality_id = parent_causality_id) as chain | fields chain.actor_process_image_name

Answer

dataset = xdr_data | filter causality_id = "<ID>" | fields actor_process_image_name, causality_id, parent_causality_id

Question 13

A Cortex XDR engineer is investigating a potential data exfiltration incident. The engineer needs to identify all outbound network connections from a specific endpoint to external IP addresses that are not in the corporate allowlist. The endpoint's hostname is 'FIN-WS-042'. Which XQL query best achieves this?

Accepted Answer

dataset = xdr_data | filter agent_hostname = "FIN-WS-042" and event_type = NETWORK | filter action_remote_ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") | fields action_remote_ip, action_remote_port. The goal is to identify outbound connections from a specific endpoint to external IP addresses. The correct query filters network events for the given hostname and then restricts the remote IP to addresses outside private RFC1918 ranges, which represents external traffic. It then projects the remote IP and port for analysis. This approach directly surfaces potential exfiltration destinations.

Answer

dataset = xdr_data | filter agent_hostname = "FIN-WS-042" and event_type = NETWORK | filter action_local_ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") and action_remote_ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") | fields action_remote_ip, action_remote_port

Answer

dataset = xdr_data | filter agent_hostname = "FIN-WS-042" and event_type = NETWORK | filter action_local_ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") | fields action_remote_ip, action_remote_port

Answer

dataset = xdr_data | filter agent_hostname = "FIN-WS-042" and event_type = NETWORK | filter action_remote_ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") | fields action_remote_ip, action_remote_port

Question 14

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

Accepted Answer

Tune the BIOC rule logic by adding specific process path exclusions or qualifying criteria.. The most appropriate next step is to tune the BIOC rule logic by adding specific process path exclusions or qualifying criteria. This reduces false positives while preserving detection coverage for malicious activity. Tuning is a standard detection engineering practice that balances security efficacy with operational noise.

Answer

Change the agent operating mode to Bypass.

Answer

Disable the entire Analytics engine on all endpoints.

Answer

Delete the BIOC rule and rely solely on default cloud-delivered IOCs.

Question 15

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

Accepted Answer

Dashboards menu using a widget based on an XQL query. Custom dashboards and widgets in Cortex XDR are built and managed within the Dashboard module using either pre-built templates or custom XQL queries.

Answer

Agent Settings -> Profiles -> Analytics

Answer

Threat Intelligence -> Feed Management

Answer

Incident Response -> Playbooks

Question 16

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR's Reporting menu includes a Scheduled Reports feature that lets administrators define report templates (including incident reports filtered to critical severity), set a weekly schedule, and configure email delivery to recipients such as the security operations team. This is the native, purpose-built capability for recurring PDF report distribution.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 17

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

Accepted Answer

Sequence or threshold-based BIOC rule. To evaluate stateful conditions across multiple events over a specific time window, sequence or threshold-based behavioral analytics / BIOC rules must be configured.

Answer

Agent Malware Prevention profile exception

Answer

Local firewall rule configuration

Answer

Static IOC file hash block rule

Question 18

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

Accepted Answer

The BIOC rule logic uses Windows-specific event fields and command structures that do not match Linux event telemetry schema.. BIOC rules contain operating system-specific syntax and event fields. A rule built exclusively for Windows event structures will not evaluate correctly against Linux OS telemetry.

Answer

The Linux agents must be rebooted into Diagnostic mode for BIOC evaluation.

Answer

Linux endpoints do not support custom BIOC rules in Cortex XDR.

Answer

Custom BIOCs require Cortex XSOAR to process Linux telemetry.

Question 19

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

Accepted Answer

BIOC Rule Builder under Analytics. Cortex XDR provides the BIOC rule builder under the Analytics section to write custom behavioral rules based on OS query or endpoint events.

Answer

Host Insights Query Builder

Answer

Cortex XSOAR Playbook Designer

Answer

IOC Management under Malware Protection

Question 20

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

Accepted Answer

Incident Details -> Causality View. The Causality View is the dedicated visualization in Cortex XDR that reconstructs the full attack story by chaining together related alerts, processes, and network events into a single causality chain. It is accessed by opening the specific incident and navigating to the Incident Details page, where the Causality View tab displays the root cause (e.g., a phishing email) through to the final malicious action (e.g., credential dumping). This view is purpose-built for exactly this kind of end-to-end forensic narrative.

Answer

Host Insights -> System Explorer

Answer

Reporting -> Scheduled Reports -> Attack Chain

Answer

Settings -> Configurations -> Causality