XDR-Engineer Detection And Reporting — Timed 10 Questions

Question 1

An analyst writes an XQL query to aggregate alert counts by severity and action, but the query returns a parsing syntax error.

dataset = xdr_data
| filter causality_actor_process_image_name != null
| comp count() by causality_actor_process_image_name

What is the correct XQL syntax correction needed to successfully execute this aggregation?

Accepted Answer

Replace 'comp count()' with 'stats count()'. In XQL, the correct aggregation command keyword is `stats` (or `ion`), not `comp`. Therefore, `comp count()` must be replaced with `stats count()_as_count` or `stats count() by ...`.

Answer

Remove the causality filter entirely because null checks are unsupported in XQL.

Answer

Change 'xdr_data' to 'panw_alerts' and use 'aggregate' instead of 'comp'.

Answer

Replace 'filter' with 'where' and remove the dataset declaration.

Question 2

A security engineer is investigating a potential lateral movement technique using WMI. The engineer wants to query the XDR backend using XQL (XDR Query Language) to search for process executions spawned by wmic.exe across all endpoints. Which XQL dataset should the query target?

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and actor_process_image_path contains 'wmic.exe'. XQL queries targeting endpoint process executions should query the XDM dataset representing process events, specifically `xdr_data` with a filter on the dataset schema for process activity.

Answer

dataset = panw_analytics_alerts | filter alert_name = 'WMI Execution'

Answer

dataset = network_story | filter protocol = 'WMI'

Answer

dataset = endpoints_inventory | filter status = 'Active'

Question 3

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

Accepted Answer

dataset = xdr_data | filter username == 'TargetUser' and _time >= now() - 24h. Filtering the `xdr_data` dataset by the specific username and a time range (`emp_time` or timestamp filters) allows full behavioral reconstruction of user activity.

Answer

dataset = endpoints_inventory | filter owner == 'TargetUser'

Answer

dataset = panw_analytics_alerts | filter alert_id == 'TargetUser'

Answer

dataset = network_story | filter user_context == null

Question 4

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

Accepted Answer

Settings -> Configurations -> License Management / Hub. License utilization, data ingestion volumes, and storage statistics in Cortex XDR are managed and viewed via the License Management / Settings menus.

Answer

Host Insights -> Disk Utilization report

Answer

Incident Response -> Queue Statistics

Answer

Analytics -> BIOC Rule Health monitor

Question 5

An organization uses Cortex XDR to ingest cloud audit logs (such as AWS CloudTrail) alongside endpoint telemetry. An analyst wants to write an XQL query to search for AWS console login failures across the `aws_cloudtrail_raw` dataset. Which XQL structure properly targets cloud logs and filters for failed logins?

Accepted Answer

dataset = aws_cloudtrail_raw | filter eventName == 'ConsoleLogin' and responseElements contains 'Failure'. Cloud audit logs ingested into Cortex XDR land in provider-specific raw datasets such as `aws_cloudtrail_raw`. To find failed AWS console logins, you query that dataset and filter on `eventName == 'ConsoleLogin'` combined with a check that `responseElements` contains 'Failure' (the field CloudTrail populates on failed authentication). This targets the correct dataset and the correct CloudTrail fields.

Answer

dataset = panw_analytics_alerts | filter source == 'AWS'

Answer

dataset = xdr_data | filter cloud_event == 'AWS_LOGIN_FAIL'

Answer

dataset = endpoints_inventory | filter cloud_provider == 'AWS'

Question 6

An administrator wants to create a new BIOC rule to detect suspicious process execution in Cortex XDR. Which menu path should the administrator navigate to in the Cortex XDR console?

Accepted Answer

Incident Response > BIOC Rules. The correct path to create a new BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR is Incident Response > BIOC Rules. This section is specifically designed for defining behavioral detection logic that triggers alerts based on process, file, network, and registry activities. BIOC rules are a core part of Cortex XDR's behavioral analytics engine, allowing administrators to write custom detection rules using the Cortex XDR rule syntax. Navigating to this menu provides the interface to create, edit, and manage these rules, including setting the rule name, description, severity, and the actual behavioral condition.

Answer

XQL Search > Query Builder

Answer

Endpoints > Policy Rules

Answer

Data Collection > Log Stitching

Question 7

An administrator wants to ensure high availability and proper auditing of user activities within the Cortex XDR management console. Which THREE administrative auditing features are available? (Choose three)

Accepted Answer

Audit Log of administrator actions within the console. Option A is correct because Cortex XDR maintains an Audit Log that records administrator actions performed within the management console, such as configuration changes, policy edits, and other privileged operations, which directly supports the auditing requirement. Option D is correct because Cortex XDR supports SAML 2.0 SSO integration, and authentication events tied to that integration (logins, identity provider assertions, and related access activity) are auditable, helping trace who accessed the console and how. Option E is correct because user login session tracking records console sign-in and session activity, providing visibility into which administrators accessed the console and when, which is essential for proper auditing. Option B is not correct because endpoint hard disk SMART status monitoring is an endpoint health/telemetry capability, not an administrative auditing feature of the management console. Option C is not correct because automatic kernel debugging dump generation relates to endpoint crash diagnostics and troubleshooting, not to auditing administrator activity in the console.

Answer

Endpoint hard disk SMART status monitoring

Answer

Automatic kernel debugging dump generation

Question 8

An administrator is designing a custom Alert-based BIOC rule in Cortex XDR. The requirement is to trigger an alert only when three distinct failed login events occur within a 5-minute window from the same source IP address. How should the aggregation and time window be configured?

Accepted Answer

Set the threshold count to 3, group by source IP address, and set the time window to 5 minutes.. Alert-based BIOC rules support aggregation and grouping by specific fields with a sliding time window to detect threshold breaches.

Answer

Set the threshold count to 5, group by event ID, and set the time window to 3 minutes.

Answer

Configure a BIOC rule using a single event trigger with a recurrence limit set to 3.

Answer

Use XQL correlation rules instead, because BIOC rules cannot evaluate time-based thresholds.

Question 9

A Cortex XDR analyst is building a scheduled XQL query to hunt for suspicious PowerShell executions. The analyst wants the query to return the count of executions per endpoint, filtered to only endpoints where the count exceeds 5. Which XQL construction correctly applies the threshold filter to the aggregated results?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" | comp count() as exec_count by agent_hostname | filter exec_count > 5. Aggregating first and then filtering is the only correct order in XQL. The comp stage produces the exec_count field keyed by agent_hostname, and a subsequent filter stage can compare that aggregated field to the threshold. Any attempt to reference count() before comp, or to use non-XQL stage keywords like where or limit for numeric comparisons, fails to express the intended threshold logic.

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" | comp count() as exec_count by agent_hostname | limit exec_count > 5

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" and count() > 5 | comp count() as exec_count by agent_hostname

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" | comp count() as exec_count by agent_hostname | where exec_count > 5

Question 10

A Cortex XDR administrator needs to ensure that all alerts generated from a specific custom BIOC rule are automatically assigned to the 'Malware Analysis' team and tagged with 'HighPriority'. Which configuration should the administrator use?

Accepted Answer

In the BIOC rule settings, configure the 'Alert Assignment' to the 'Malware Analysis' team and add a tag 'HighPriority'.. Cortex XDR BIOC rules include native fields for alert assignment and tagging. By configuring the 'Alert Assignment' to the 'Malware Analysis' team and adding the 'HighPriority' tag within the rule, all alerts generated by that rule are automatically routed and labeled, fulfilling the requirement without external automation.

Answer

Use the Cortex XDR API to poll for new alerts and update their assignment and tags programmatically.

Answer

Configure a global alert exclusion rule that matches the BIOC rule name and applies the assignment and tag.

Answer

Create a playbook in Cortex XSOAR that assigns the alert and adds the tag when the BIOC rule triggers.