XDR-Engineer Detection And Reporting — Timed 15 Questions

Question 1

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

Accepted Answer

Tune the BIOC rule logic by adding specific process path exclusions or qualifying criteria.. Tuning detection logic by refining filters, excluding specific process paths, or adding qualifying criteria is the standard method to handle false positives.

Answer

Change the agent operating mode to Bypass.

Answer

Disable the entire Analytics engine on all endpoints.

Answer

Delete the BIOC rule and rely solely on default cloud-delivered IOCs.

Question 2

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

Accepted Answer

Dashboards menu using a widget based on an XQL query. Custom dashboards and widgets in Cortex XDR are built and managed within the Dashboard module using either pre-built templates or custom XQL queries.

Answer

Agent Settings -> Profiles -> Analytics

Answer

Threat Intelligence -> Feed Management

Answer

Incident Response -> Playbooks

Question 3

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR allows administrators to schedule reports through the Reporting section by defining parameters and delivery frequency.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 4

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

Accepted Answer

Sequence or threshold-based BIOC rule. To evaluate stateful conditions across multiple events over a specific time window, sequence or threshold-based behavioral analytics / BIOC rules must be configured.

Answer

Agent Malware Prevention profile exception

Answer

Local firewall rule configuration

Answer

Static IOC file hash block rule

Question 5

An analyst writes an XQL query to aggregate alert counts by severity and action, but the query returns a parsing syntax error.

dataset = xdr_data
| filter causality_actor_process_image_name != null
| comp count() by causality_actor_process_image_name

What is the correct XQL syntax correction needed to successfully execute this aggregation?

Accepted Answer

Replace 'comp count()' with 'stats count()'. In XQL, the correct aggregation command keyword is `stats` (or `ion`), not `comp`. Therefore, `comp count()` must be replaced with `stats count()_as_count` or `stats count() by ...`.

Answer

Remove the causality filter entirely because null checks are unsupported in XQL.

Answer

Change 'xdr_data' to 'panw_alerts' and use 'aggregate' instead of 'comp'.

Answer

Replace 'filter' with 'where' and remove the dataset declaration.

Question 6

A security engineer is investigating a potential lateral movement technique using WMI. The engineer wants to query the XDR backend using XQL (XDR Query Language) to search for process executions spawned by wmic.exe across all endpoints. Which XQL dataset should the query target?

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and actor_process_image_path contains 'wmic.exe'. XQL queries targeting endpoint process executions should query the XDM dataset representing process events, specifically `xdr_data` with a filter on the dataset schema for process activity.

Answer

dataset = panw_analytics_alerts | filter alert_name = 'WMI Execution'

Answer

dataset = network_story | filter protocol = 'WMI'

Answer

dataset = endpoints_inventory | filter status = 'Active'

Question 7

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

Accepted Answer

The BIOC rule logic uses Windows-specific event fields and command structures that do not match Linux event telemetry schema.. BIOC rules contain operating system-specific syntax and event fields. A rule built exclusively for Windows event structures will not evaluate correctly against Linux OS telemetry.

Answer

The Linux agents must be rebooted into Diagnostic mode for BIOC evaluation.

Answer

Linux endpoints do not support custom BIOC rules in Cortex XDR.

Answer

Custom BIOCs require Cortex XSOAR to process Linux telemetry.

Question 8

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

Accepted Answer

BIOC Rule Builder under Analytics. Cortex XDR provides the BIOC rule builder under the Analytics section to write custom behavioral rules based on OS query or endpoint events.

Answer

Host Insights Query Builder

Answer

Cortex XSOAR Playbook Designer

Answer

IOC Management under Malware Protection

Question 9

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

Accepted Answer

Incident Details -> Causality View. The Causality View within the Incident Details page provides the visual attack story graph mapping out process ancestry and network activity.

Answer

Host Insights -> System Explorer

Answer

Reporting -> Scheduled Reports -> Attack Chain

Answer

Settings -> Configurations -> Causality

Question 10

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

Accepted Answer

Endpoint Management view in the Cortex XDR console. The Endpoint Management page provides a real-time inventory of all enrolled agents, their status, and last seen timestamps.

Answer

BIOC Rule Testing interface

Answer

Incident triage queue

Answer

Security Information and Event Management (SIEM) export logs

Question 11

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

Accepted Answer

stats host_count = count(distinct hostname) by actor_process_image_name | filter host_count <= 50. After using `stats` to aggregate and calculate distinct host counts (e.g., `stats host_count = count(distinct hostname)`), the subsequent `filter` command must be applied to the newly created aggregate field `host_count <= 50`.

Answer

filter host_count <= 50 | stats host_count = count(distinct hostname) by actor_process_image_name

Answer

group by actor_process_image_name having count(distinct hostname) <= 50

Answer

stats host_count = count(hostname) where host_count <= 50

Question 12

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

Accepted Answer

Incident Management / Incident Rules configuration. Cortex XDR allows administrators to configure Incident View rules or Alert forwarding / Incident automation rules to automatically assign, tag, and categorize incoming alerts matching specific criteria.

Answer

Agent installation package properties

Answer

Cortex XDR Collector configuration file

Answer

BIOC exclusion profile settings

Question 13

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Accepted Answer

Export and Import options within the BIOC management interface. Cortex XDR provides administrative export and import capabilities under Analytics / BIOC rules to manage rule portability.

Answer

Agent deployment script parameter flags

Answer

Cortex XDR API key generation settings

Answer

Data Export Service configuration bucket

Question 14

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

Accepted Answer

dataset = xdr_data | filter username == 'TargetUser' and _time >= now() - 24h. Filtering the `xdr_data` dataset by the specific username and a time range (`emp_time` or timestamp filters) allows full behavioral reconstruction of user activity.

Answer

dataset = endpoints_inventory | filter owner == 'TargetUser'

Answer

dataset = panw_analytics_alerts | filter alert_id == 'TargetUser'

Answer

dataset = network_story | filter user_context == null

Question 15

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

Accepted Answer

Settings -> Configurations -> License Management / Hub. License utilization, data ingestion volumes, and storage statistics in Cortex XDR are managed and viewed via the License Management / Settings menus.

Answer

Host Insights -> Disk Utilization report

Answer

Incident Response -> Queue Statistics

Answer

Analytics -> BIOC Rule Health monitor