XDR-Engineer Ingestion And Automation — Timed 20 Questions

Question 1

A security analyst needs to ingest custom JSON-formatted security logs from an in-house application into Cortex XDR. Where should the administrator define the custom log mapping to ensure fields are parsed correctly under the generic log profile schema?

20 minute time limit — choose an answer to begin.

Accepted Answer

In the Cortex XDR console under Settings > Configurations > Data Integration > Custom Log Mapping. Custom log mapping for JSON logs is defined in the Cortex XDR console under Settings > Configurations > Data Integration > Custom Log Mapping. This allows administrators to map fields from the custom JSON to the generic log profile schema, ensuring proper parsing and normalization. This centralized configuration is the correct place to define such mappings.

Answer

In the Cortex XaaS cloud storage bucket configuration properties

Answer

Directly inside the broker VM configuration file using a local JSON editor

Answer

In the Cortex XDR agent installation script via command-line switches

Question 2

An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?

Accepted Answer

GET /public_api/v1/endpoints/get_endpoint/ with an explicit JSON filter for last_seen timestamp. The correct API endpoint is GET /public_api/v1/endpoints/get_endpoint/ with a JSON filter specifying the last_seen timestamp condition. This endpoint retrieves endpoint details and supports filtering, allowing the script to query for endpoints not checked in within the last 7 days. Other endpoints are for different purposes and do not support this filtering.

Answer

POST /public_api/v1/incidents/get_all_incidents/ with a severity filter

Answer

PUT /public_api/v1/audits/get_actions/ with an agent version parameter

Answer

GET /public_api/v1/file/file_metadata/ with a SHA256 parameter

Question 3

An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?

Accepted Answer

Run the 'ExtractIOCs' parsing command on the email body field. ExtractIOCs is a core Cortex XSOAR parsing command used to extract indicators from unstructured text like emails.

Answer

Forward the raw email to the Cortex XDR Agent collector service

Answer

Trigger the 'Device-Control-Block' command against the email sender

Answer

Execute a raw regex match script via PowerShell on a Broker VM worker

Question 4

An administrator has configured a Cortex XDR data ingestion rule for a custom log source, but fields are appearing under the 'general_fields' object rather than their designated mapped schema columns. What is the most likely reason for this parsing failure?

Accepted Answer

The custom log mapping configuration has incorrect field names or unmatched JSON/regex keys. If custom fields do not map correctly, it is usually because the JSON key names or regex capture groups do not match the custom log mapping definition.

Answer

The log forwarding protocol must be changed from HTTPS to UDP

Answer

The Cortex XDR agent license does not support custom parsing

Question 5

When configuring advanced data forwarding filters in Cortex XDR, which TWO criteria parameters can an administrator use to precisely target specific log types or endpoints? (Choose two)

Accepted Answer

Log dataset type (e.g., xdr_data, endpoints, network). Option B is correct because Cortex XDR's advanced data forwarding filters let administrators select the log dataset type (for example xdr_data, endpoints, or network) so that only specific telemetry categories are forwarded to the destination. Option E is correct because alert severity levels (Low, Medium, High, Critical) are a supported filter criterion, allowing forwarding to be scoped to alerts of a given severity. Options A, C, and D are not valid filtering parameters in Cortex XDR; physical room numbers, security guard names, and cafeteria menus are unrelated to the data model and cannot be used to target log types or endpoints.

Answer

The physical room number where the server rack is installed

Answer

The name of the physical building security guard on duty

Answer

The local cafeteria menu schedule

Question 6

An administrator is configuring a new Syslog data collector in Cortex XDR to ingest logs from a third-party firewall. The logs are arriving at the Cortex XDR Collector, but they are not appearing in the Query Builder. Which step should the administrator perform to resolve this issue?

Accepted Answer

Configure a custom log mapping in the Broker VM configuration to parse the incoming syslog format.. When syslog logs arrive at the Cortex XDR Collector but do not appear in the Query Builder, the most likely cause is that the logs are not being parsed into the expected schema. Configuring a custom log mapping in the Broker VM allows the administrator to define how the incoming syslog format maps to Cortex XDR fields, enabling the logs to be indexed and queried. This is the correct step to resolve the parsing issue.

Answer

Disable SSL/TLS verification on the firewall sending the syslog events.

Answer

Generate a new API key in the Cortex XDR management console and assign it to the syslog source.

Answer

Restart the Cortex XDR Agent on all managed endpoints to enable syslog forwarding.

Question 7

An XDR administrator needs to forward Cortex XDR alerts to an external SIEM. Which integration mechanism should be configured in the Cortex XDR management console under Data Collection?

Accepted Answer

Cortex XDR Streaming API. Cortex XDR provides direct integration with external SIEMs using the Syslog or HTTPS streaming feature available in the Data Collection configuration menu, allowing seamless alert forwarding.

Answer

Endpoint Tagging Policy

Answer

Local Agent Settings Profile

Answer

Hash Exception Rule

Question 8

Where in the Cortex XDR management console can an administrator review the status and health of all connected data collectors, such as Broker VMs and agent collectors?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Broker VM.. The Data Collection menu in the Cortex XDR management console contains the Broker VM and collectors status pages, giving administrators complete visibility into collector health.

Answer

Open Endpoint Management > Agent States > Collectors.

Answer

Select Response > Automation > Integrations.

Answer

Go to Incidents > Alert Overview > Collector Health.

Question 9

An administrator is configuring the Cortex XDR API integration for automated incident management and data ingestion. Which TWO actions must be performed in the Cortex XDR management console to properly set up API access? (Choose two)

Accepted Answer

Generate an API Key ID and corresponding API Key secret in Settings > Configurations > Integrations > API Keys.. Option A is correct because API access in Cortex XDR begins by generating an API Key ID and its paired API Key secret under Settings > Configurations > Integrations > API Keys, which produces the credentials used to authenticate REST calls for automated incident management and data ingestion. Option C is correct because each API key must be assigned a role (such as Viewer or Administrator) that defines its permission scope, ensuring the integration has the appropriate read/write privileges for the required API operations. Option B is incorrect because API keys are not bound to endpoint groups via agent criteria filters; endpoint group membership is determined by agent registration and policy targeting, not by API key configuration. Option D is incorrect because the Broker VM is used for on-premises log collection, agent management, and proxy functions, not for hosting a local system account to proxy API REST calls. Option E is incorrect because there is no 'Cortex XDR API forwarder agent' package installed on a SIEM server; SIEM integration is achieved through API calls or log forwarding, not by installing an agent on the SIEM host.

Answer

Bind the API key to a specific endpoint group using an agent criteria filter.

Answer

Configure a local system account on the Broker VM to proxy incoming API REST calls.

Answer

Install the Cortex XDR API forwarder agent package directly onto the SIEM server.

Question 10

A security engineer is configuring a Cortex XDR data forwarding rule to send only endpoint alert data to an external SIEM. The SIEM expects each event to include the raw endpoint telemetry in its original structure. The engineer wants to minimize transformation overhead and ensure the SIEM receives the unmodified payload. Which Cortex XDR data forwarding configuration should the engineer select to meet this requirement?

Accepted Answer

Use the 'Raw' data format with the original endpoint event schema and forward directly to the SIEM.. Cortex XDR data forwarding can transmit events in their original raw format, preserving the endpoint-generated schema without normalization. When a SIEM requires unmodified telemetry and the goal is to minimize transformation, selecting the raw format is appropriate. Normalized formats like CEF or LEEF alter the payload structure and add mapping steps, which contradicts the requirement.

Answer

Use the 'LEEF' format and apply custom field mappings to preserve endpoint event hierarchy.

Answer

Configure the forwarding rule to send only alert metadata without endpoint telemetry to reduce bandwidth.

Answer

Enable the 'CEF' format and map all endpoint fields to Common Event Format headers before forwarding.

Question 11

An XDR engineer needs to ingest logs from a custom in-house application into Cortex XDR. The application can only send logs over HTTP to a specific endpoint. The engineer decides to use the Cortex XDR HTTP Log Collector. Which configuration step is required to ensure the logs are parsed correctly into Cortex XDR?

Accepted Answer

Define a custom log format in the HTTP Log Collector settings using a regular expression or key-value pairs.. The HTTP Log Collector is designed to ingest logs sent via HTTP. To parse custom logs, a custom log format must be defined using regex or key-value pairs. This allows Cortex XDR to extract relevant fields and map them to the schema for further analysis. Without this, logs would be ingested as raw text and not usable for detections.

Answer

Configure the application to send logs in CEF format and enable the CEF parser in the collector.

Answer

Enable the Syslog Collector and configure the application to send logs via Syslog over TCP.

Answer

Use the Broker VM to receive HTTP logs and forward them to the Cortex XDR management console.

Question 12

An XDR engineer is setting up the Cortex XDR Syslog Collector to receive logs from a firewall. The firewall sends logs in RFC 5424 format over TCP. Which configuration is necessary on the Syslog Collector to ensure proper ingestion?

Accepted Answer

Enable the RFC 5424 parser and specify the TCP port.. The Syslog Collector must be configured to match the incoming log format and transport. Since the firewall uses RFC 5424 over TCP, the collector should enable the RFC 5424 parser and listen on the correct TCP port. This ensures the logs are parsed correctly and ingested into Cortex XDR.

Answer

Enable TLS encryption and use the default syslog port 514.

Answer

Configure the collector to use UDP and set the format to RFC 3164.

Answer

Set the collector to listen on a random port and use automatic format detection.

Question 13

A Cortex XDR administrator needs to ensure that alerts generated by the Cortex XDR Analytics engine are automatically enriched with threat intelligence before being forwarded to a downstream ticketing system. The enrichment must occur without manual intervention. Which Cortex XDR component should be configured to achieve this?

Accepted Answer

Cortex XDR Automation (Cortex XSOAR engine). The correct answer is Cortex XDR Automation, because it is the built-in orchestration engine that can trigger playbooks on analytics alerts, query integrated threat intelligence sources, and append enrichment data automatically. Data Forwarding only sends alerts, API scripts require external code, and Broker VM does not enrich alerts. Automation is the native, no-code way to achieve automatic enrichment before ticketing.

Answer

Cortex XDR Data Forwarding with syslog filters

Answer

Cortex XDR Broker VM with Threat Intelligence add-on

Answer

Cortex XDR API with external scripts polling for new alerts

Question 14

An administrator has deployed a Cortex XDR Broker VM and needs to collect Windows Event Logs from a remote domain-joined server that does not have the Cortex XDR agent installed. The server sits on a segmented VLAN that only allows outbound SMB traffic to the Broker VM host. Which Broker VM component should be configured to pull these logs?

Accepted Answer

Windows Event Collector (WEC) using the Broker VM's built-in collector. Windows Event Log ingestion from agentless Windows hosts is handled by the Broker VM's Windows Event Collector, which connects to remote machines over SMB/RPC and reads specified event channels. Because the network policy already permits SMB from the segmented server to the Broker VM, the WEC can authenticate and pull the logs. Syslog, Network Mapper, and File Collector serve different ingestion purposes and cannot read Windows event channels.

Answer

File Collector watching the remote server's C$ administrative share

Answer

Syslog Collector with a listening port on the Broker VM

Answer

Network Mapper with SNMP walk enabled for Windows hosts

Question 15

An administrator is configuring data forwarding from Cortex XDR to an external SIEM. They need to ensure that only high-severity alerts are forwarded and that the forwarded data includes endpoint hostname and alert timestamp. Which TWO configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Enable the 'Include endpoint hostname' option in the forwarding configuration.. To forward only high-severity alerts, a forwarding filter with a severity condition is needed. To include endpoint hostname, the corresponding option must be enabled in the forwarding configuration. These two elements together meet the stated requirements.

Answer

Set the forwarding format to CSV.

Answer

Add a filter condition for 'alert timestamp' to be within the last 24 hours.

Answer

Configure the SIEM to poll the Cortex XDR API every 5 minutes.

Question 16

An administrator is configuring a Cortex XDR data forwarding rule to send only alerts with a severity of 'High' or 'Critical' to a third-party SIEM. The SIEM expects alerts in JSON format over syslog. Which configuration should the administrator apply?

Accepted Answer

Create a data forwarding rule with a filter for severity >= High and set the format to JSON over syslog.. The correct approach is to use a Cortex XDR data forwarding rule with a severity filter and JSON over syslog format. This native feature allows precise filtering and formatting. API scripting is custom and not the intended method, pulling from SIEM is not supported, and Broker VM is for log ingestion, not alert forwarding. Thus, the built-in forwarding rule is the right configuration.

Answer

Configure the SIEM to pull alerts from Cortex XDR using a syslog collector with a severity filter.

Answer

Use the Cortex XDR API to query alerts with severity High or Critical and push them to the SIEM via a custom script.

Answer

Set up a Broker VM to collect all alerts and then filter them locally before forwarding to the SIEM.

Question 17

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 18

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Accepted Answer

A Condition (or Decision) block that evaluates the sandbox verdict output. Conditional routing in playbooks is handled using Decision or Condition tasks to evaluate previous task outputs.

Answer

A Data Collection task pointing to the endpoint agent

Answer

A Post-Processing script executed directly on the Broker VM

Answer

A Manual Approval step without automated logic branching

Question 19

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

Accepted Answer

Settings > Configurations > Data Integration > Broker VM. Broker VM monitoring and status can be checked under Settings > Configurations > Data Integration > Broker VM.

Answer

Incidents > Response > Broker Status

Answer

Marketplace > Integrations > Instances

Answer

Endpoints > Management > Agent Status

Question 20

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

Accepted Answer

To uniquely identify a specific configuration and credential set for an integration. Integration instances allow administrators to configure multiple instances of the same integration with different parameters, each identified by a unique instance name.

Answer

To determine the operating system kernel executing the automation script

Answer

To define the encryption key used for secure payload transit

Answer

To specify the physical network interface the integration binds to