XDR-Engineer Ingestion And Automation — 10 Questions

Question 1

A security analyst needs to ingest custom JSON-formatted security logs from an in-house application into Cortex XDR. Where should the administrator define the custom log mapping to ensure fields are parsed correctly under the generic log profile schema?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Cortex XDR console under Settings > Configurations > Data Integration > Custom Log Mapping. Custom log mapping for JSON logs is defined in the Cortex XDR console under Settings > Configurations > Data Integration > Custom Log Mapping. This allows administrators to map fields from the custom JSON to the generic log profile schema, ensuring proper parsing and normalization. This centralized configuration is the correct place to define such mappings.

Answer

In the Cortex XaaS cloud storage bucket configuration properties

Answer

Directly inside the broker VM configuration file using a local JSON editor

Answer

In the Cortex XDR agent installation script via command-line switches

Question 2

An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?

Accepted Answer

GET /public_api/v1/endpoints/get_endpoint/ with an explicit JSON filter for last_seen timestamp. The correct API endpoint is GET /public_api/v1/endpoints/get_endpoint/ with a JSON filter specifying the last_seen timestamp condition. This endpoint retrieves endpoint details and supports filtering, allowing the script to query for endpoints not checked in within the last 7 days. Other endpoints are for different purposes and do not support this filtering.

Answer

POST /public_api/v1/incidents/get_all_incidents/ with a severity filter

Answer

PUT /public_api/v1/audits/get_actions/ with an agent version parameter

Answer

GET /public_api/v1/file/file_metadata/ with a SHA256 parameter

Question 3

An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?

Accepted Answer

Run the 'ExtractIOCs' parsing command on the email body field. ExtractIOCs is a core Cortex XSOAR parsing command used to extract indicators from unstructured text like emails.

Answer

Forward the raw email to the Cortex XDR Agent collector service

Answer

Trigger the 'Device-Control-Block' command against the email sender

Answer

Execute a raw regex match script via PowerShell on a Broker VM worker

Question 4

An administrator has configured a Cortex XDR data ingestion rule for a custom log source, but fields are appearing under the 'general_fields' object rather than their designated mapped schema columns. What is the most likely reason for this parsing failure?

Accepted Answer

The custom log mapping configuration has incorrect field names or unmatched JSON/regex keys. If custom fields do not map correctly, it is usually because the JSON key names or regex capture groups do not match the custom log mapping definition.

Answer

The log forwarding protocol must be changed from HTTPS to UDP

Answer

The Cortex XDR agent license does not support custom parsing

Question 5

When configuring advanced data forwarding filters in Cortex XDR, which TWO criteria parameters can an administrator use to precisely target specific log types or endpoints? (Choose two)

Accepted Answer

Log dataset type (e.g., xdr_data, endpoints, network). Option B is correct because Cortex XDR's advanced data forwarding filters let administrators select the log dataset type (for example xdr_data, endpoints, or network) so that only specific telemetry categories are forwarded to the destination. Option E is correct because alert severity levels (Low, Medium, High, Critical) are a supported filter criterion, allowing forwarding to be scoped to alerts of a given severity. Options A, C, and D are not valid filtering parameters in Cortex XDR; physical room numbers, security guard names, and cafeteria menus are unrelated to the data model and cannot be used to target log types or endpoints.

Answer

The physical room number where the server rack is installed

Answer

The name of the physical building security guard on duty

Answer

The local cafeteria menu schedule

Question 6

An administrator is configuring a new Syslog data collector in Cortex XDR to ingest logs from a third-party firewall. The logs are arriving at the Cortex XDR Collector, but they are not appearing in the Query Builder. Which step should the administrator perform to resolve this issue?

Accepted Answer

Configure a custom log mapping in the Broker VM configuration to parse the incoming syslog format.. When syslog logs arrive at the Cortex XDR Collector but do not appear in the Query Builder, the most likely cause is that the logs are not being parsed into the expected schema. Configuring a custom log mapping in the Broker VM allows the administrator to define how the incoming syslog format maps to Cortex XDR fields, enabling the logs to be indexed and queried. This is the correct step to resolve the parsing issue.

Answer

Disable SSL/TLS verification on the firewall sending the syslog events.

Answer

Generate a new API key in the Cortex XDR management console and assign it to the syslog source.

Answer

Restart the Cortex XDR Agent on all managed endpoints to enable syslog forwarding.

Question 7

An XDR administrator needs to forward Cortex XDR alerts to an external SIEM. Which integration mechanism should be configured in the Cortex XDR management console under Data Collection?

Accepted Answer

Cortex XDR Streaming API. Cortex XDR provides direct integration with external SIEMs using the Syslog or HTTPS streaming feature available in the Data Collection configuration menu, allowing seamless alert forwarding.

Answer

Endpoint Tagging Policy

Answer

Local Agent Settings Profile

Answer

Hash Exception Rule

Question 8

Where in the Cortex XDR management console can an administrator review the status and health of all connected data collectors, such as Broker VMs and agent collectors?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Broker VM.. The Data Collection menu in the Cortex XDR management console contains the Broker VM and collectors status pages, giving administrators complete visibility into collector health.

Answer

Open Endpoint Management > Agent States > Collectors.

Answer

Select Response > Automation > Integrations.

Answer

Go to Incidents > Alert Overview > Collector Health.

Question 9

An administrator is configuring the Cortex XDR API integration for automated incident management and data ingestion. Which TWO actions must be performed in the Cortex XDR management console to properly set up API access? (Choose two)

Accepted Answer

Generate an API Key ID and corresponding API Key secret in Settings > Configurations > Integrations > API Keys.. Option A is correct because API access in Cortex XDR begins by generating an API Key ID and its paired API Key secret under Settings > Configurations > Integrations > API Keys, which produces the credentials used to authenticate REST calls for automated incident management and data ingestion. Option C is correct because each API key must be assigned a role (such as Viewer or Administrator) that defines its permission scope, ensuring the integration has the appropriate read/write privileges for the required API operations. Option B is incorrect because API keys are not bound to endpoint groups via agent criteria filters; endpoint group membership is determined by agent registration and policy targeting, not by API key configuration. Option D is incorrect because the Broker VM is used for on-premises log collection, agent management, and proxy functions, not for hosting a local system account to proxy API REST calls. Option E is incorrect because there is no 'Cortex XDR API forwarder agent' package installed on a SIEM server; SIEM integration is achieved through API calls or log forwarding, not by installing an agent on the SIEM host.

Answer

Bind the API key to a specific endpoint group using an agent criteria filter.

Answer

Configure a local system account on the Broker VM to proxy incoming API REST calls.

Answer

Install the Cortex XDR API forwarder agent package directly onto the SIEM server.

Question 10

A security engineer is configuring a Cortex XDR data forwarding rule to send only endpoint alert data to an external SIEM. The SIEM expects each event to include the raw endpoint telemetry in its original structure. The engineer wants to minimize transformation overhead and ensure the SIEM receives the unmodified payload. Which Cortex XDR data forwarding configuration should the engineer select to meet this requirement?

Accepted Answer

Use the 'Raw' data format with the original endpoint event schema and forward directly to the SIEM.. Cortex XDR data forwarding can transmit events in their original raw format, preserving the endpoint-generated schema without normalization. When a SIEM requires unmodified telemetry and the goal is to minimize transformation, selecting the raw format is appropriate. Normalized formats like CEF or LEEF alter the payload structure and add mapping steps, which contradicts the requirement.

Answer

Use the 'LEEF' format and apply custom field mappings to preserve endpoint event hierarchy.

Answer

Configure the forwarding rule to send only alert metadata without endpoint telemetry to reduce bandwidth.

Answer

Enable the 'CEF' format and map all endpoint fields to Common Event Format headers before forwarding.