Alert Lifecycle And Incident Correlation

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

An analyst is reviewing a Cortex XDR incident that was created by the correlation engine. The analyst wants to understand why certain alerts were grouped together. Which two factors does the Cortex XDR correlation engine primarily use to stitch alerts into a single incident? (Choose two.)

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

An analyst is investigating a Cortex XDR incident that was automatically created from a high-severity alert. The analyst determines that the alert is a false positive and wants to ensure that future identical alerts do not create new incidents. What is the most appropriate action?

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

An analyst is investigating a Cortex XDR incident that includes both endpoint and network alerts. They notice that the incident's timeline shows a gap between a network alert indicating a suspicious outbound connection and a subsequent endpoint alert for process execution. The analyst suspects that the two alerts are related but were not stitched into the same incident. What is the most likely reason for the failure to correlate these alerts into a single incident?

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

A Cortex XDR analyst receives a critical incident for an endpoint that was quarantined by the organization months ago but is still generating new alerts. The analyst wants to quickly verify whether the endpoint has had any recent network activity that could indicate the alerts are from a live but unmanaged device. Which Cortex XDR feature should the analyst use to view the latest network connections associated with that endpoint?

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that are not related to the same attack. The analyst wants to manually split these unrelated alerts into separate incidents to improve tracking. Which action should the analyst take within the incident view?

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

A security analyst receives a Cortex XDR incident that was automatically created from multiple alerts. The analyst wants to assign the incident to a specific team member for further investigation. Which action should the analyst take?

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

An analyst is reviewing a Cortex XDR incident and wants to identify all alerts within the incident that are mapped to the 'Execution' tactic in the MITRE ATT&CK framework. Which TWO methods can the analyst use to achieve this? (Choose two.)

An analyst is reviewing a Cortex XDR incident and wants to quickly see which alerts are associated with the incident and their current status. Where should the analyst look?

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

An analyst is reviewing a Cortex XDR incident that contains multiple alerts from different endpoints. The analyst wants to identify the root cause and determine the scope of the attack. Which TWO actions should the analyst take to achieve this? (Choose two.)

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

An analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst wants to see a visual representation of how the alerts are related over time to better understand the attack progression. Which Cortex XDR feature should the analyst use?

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

An analyst is investigating a Cortex XDR incident that contains several alerts from different endpoints. The analyst wants to quickly identify the root cause alert that initiated the incident and understand the sequence of events. Which feature in the incident details view provides a chronological timeline of all related alerts and activities?

An analyst is examining a Cortex XDR incident that includes a high-severity alert for a suspicious process execution. The analyst wants to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

During data stitching across endpoints and networks, what THREE core attributes does Cortex XDR typically leverage to correlate disparate logs into a single incident? (Choose three)

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

What is the primary purpose of starring an alert within an incident details pane?

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

An analyst is investigating a Cortex XDR incident where the same alert appears multiple times with different timestamps. The analyst wants to understand why the alert was duplicated. Which factor is most likely responsible for the duplicate alerts within the incident?

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

An analyst notices that a Cortex XDR incident contains alerts from two different endpoints that appear to be part of the same attack campaign. The analyst wants to confirm that the incidents are linked by a common threat actor. Which Cortex XDR feature provides a graphical representation of the relationships between alerts, endpoints, and indicators of compromise (IOCs) to help identify such connections?

An incident responder is investigating a complex incident in Cortex XDR and needs to examine the raw alert-to-incident lifecycle and data stitching relationships. Which THREE components or views in the Cortex XDR console should the responder utilize to thoroughly analyze this data? (Choose three)

An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

During incident triage, an analyst notices that a Cortex XDR incident contains alerts from both a Windows endpoint and a Linux server. The analyst wants to see the specific MITRE ATT&CK techniques associated with each alert to understand the adversary's tactics. Where can the analyst find this information?

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

An analyst is investigating a Cortex XDR incident where the automatic correlation engine grouped alerts based on a shared causality ID. The analyst discovers that one alert in the incident actually belongs to a different attack on the same endpoint. What should the analyst do to correct the incident grouping?

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

What action should an analyst take in Cortex XDR when an incident investigation is fully complete and all remediation steps have been verified?

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

An analyst needs to quickly identify all incidents in Cortex XDR that are related to a specific MITRE ATT&CK technique, such as T1059 (Command and Scripting Interpreter). What is the most efficient way to find these incidents?

An analyst is triaging a Cortex XDR incident that contains a mix of high and low severity alerts. The analyst wants to quickly identify which alerts are most critical to address first. Which column in the Incident View's Alerts tab should the analyst sort by to prioritize alerts based on their potential impact?