troubleshooting

An analyst needs to assess the external attack surface of a newly acquired subsidiary whose primary domain is registered under a different parent organization. The analyst plans to configure an Attack Surface Management (ASM) scan in Cortex XSIAM. Which TWO configuration elements must be defined so that ASM can discover external assets associated with this subsidiary? (Choose two.)

An analyst wants to reuse the same sequence of enrichment, scoring, and notification tasks across five different playbooks without duplicating the logic in each. Which XSIAM construct should be used to achieve this reuse?

An analyst is building an XQL query to detect suspicious PowerShell execution. They want to exclude any command line that contains the string 'Invoke-WebRequest' and also exclude any command line that contains 'DownloadString'. Which XQL filter expression correctly applies both exclusions?

An XSIAM analyst is reviewing the Analytics page and notices that a particular analytic rule is generating a large number of alerts that are not being grouped into incidents. The analyst wants to verify whether the rule is configured to create incidents. Which setting should the analyst check in the analytic rule configuration?

A Cortex XSIAM playbook includes a task that calls an external threat intelligence API. The API occasionally returns a rate-limit error (HTTP 429). The analyst wants the playbook to retry the call a few times with increasing delays before giving up and continuing with the rest of the playbook. Which configuration on the task best achieves this?

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

An incident response team wants to customize the incident severity scoring in XSIAM to better reflect organizational risk. Where are incident risk scoring and severity mapping configurations managed?

An analyst needs to ensure that all incidents assigned to a specific threat group are automatically tagged with a custom label upon creation. Where can the analyst configure automatic tagging rules?

During an incident investigation in XSIAM, an analyst needs to determine the root cause of a suspicious process execution. The analyst has the process GUID and wants to see the full command line, parent process, and user context. Which XSIAM capability provides this information?

An analyst is building a playbook that must conditionally route incidents based on the severity field returned by an external enrichment integration. Which TWO configuration elements are required for the conditional branching to evaluate that field correctly? (Choose two.)

A security team wants a Cortex XSIAM playbook to run automatically the moment a new high-severity incident is created, without any analyst clicking a button. Which configuration makes the playbook start on its own when the incident is generated?

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

A Cortex XSIAM analyst is investigating an external-facing asset discovered by Attack Surface Management (ASM). The asset appears in the inventory but has no associated service, certificate, or technology details, and the analyst needs to understand what ASM actually observed. Which action should the analyst take to review the raw discovery evidence for this asset?

What is the primary purpose of the Cortex Data Model (CDM) in XSIAM?

An analyst is validating that Cortex XSIAM threat intelligence is being applied correctly to internal telemetry. The analyst wants to confirm which internal data sources are being matched against ingested indicators. Which TWO capabilities should the analyst use to verify indicator matches against internal telemetry? (Choose two.)

An analyst concludes an incident investigation and determines that the alert was a true positive, remediation actions have been completed, and no further steps are needed. What is the correct final state to assign to the incident in XSIAM?

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

An XSIAM analyst is investigating a phishing incident where a user clicked a malicious link and downloaded a payload. The analyst needs to determine the scope of the compromise by identifying all endpoints that communicated with the malicious domain. Which TWO XSIAM capabilities should the analyst use to efficiently identify affected endpoints? (Choose two.)

An administrator is configuring the Cortex XDR agent on a group of endpoints and wants to ensure that users cannot uninstall the agent or stop its service without providing a password. Which setting should the administrator enable in the XSIAM management console?

A Cortex XSIAM playbook contains a task that calls an internal ticketing API. The API occasionally returns HTTP 429 when the ticketing system is under heavy load. The analyst wants the playbook to retry the call a few times before marking the task as failed. Which task configuration should be applied?

An analyst wants to enrich Cortex XSIAM incidents with context from an external threat intelligence provider so that severity and indicator reputation appear directly on the incident. The provider exposes a REST API keyed by indicator value. Which Cortex XSIAM capability should the analyst use to bring this context into incidents?

A security analyst needs to review authentication events from the last 24 hours and display only the username, source IP address, and timestamp. The events are stored in the dataset xdr_data with event_type ENUM.AUTHENTICATION. Which XQL query correctly filters the time range and selects the required fields?

A security engineer wants to reuse the same set of containment steps across several different playbooks that handle malware, phishing, and unauthorized access incidents. The steps include isolating an endpoint, disabling a user account, and blocking a hash. The engineer wants to maintain these steps in one place so that updates propagate to all playbooks. What should the engineer do in Cortex XSIAM?

An XSIAM analyst is triaging a new high-severity incident. During investigation, the analyst determines that the activity is benign and wants to close the incident while ensuring that similar alerts are not re-triggered for this known-good activity. Which incident resolution action should the analyst take?

A Cortex XSIAM playbook is triggered by a new incident and runs an isolation task on the affected endpoint. The analyst wants the playbook to pause and require a human to approve the isolation before it executes, because the endpoint belongs to an executive. Which task type should be placed before the isolation task?

A playbook contains a parallel task branch where two different enrichment integrations run simultaneously. One integration fails due to a rate limit. How can you prevent the entire playbook from failing and allow the other branch to complete successfully?

A Cortex XSIAM playbook task calls an external service, but the service is intermittently unavailable, causing the task to fail. You want the playbook to attempt the call again a few times before declaring failure, without stopping the rest of the playbook. Which approach should you implement?

An analyst needs to create an XQL query that enriches network connection events with geographic location data. The analyst has a lookup table named 'ip_geolocation' that maps IP addresses to country codes. The goal is to add a 'country' field to each event based on the destination IP address. Which XQL stage and syntax correctly performs this enrichment?

When configuring incident notification settings in XSIAM, which TWO notification channels are natively supported for alerting analysts about new high-severity incidents? (Choose two)

An analyst is building a Cortex XSIAM playbook that enriches indicators by calling an external REST API. The API enforces a rate limit of 10 requests per minute, and the playbook may process incidents containing hundreds of indicators. Which playbook task configuration should the analyst apply to avoid HTTP 429 responses while still processing every indicator?

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

An analyst in the Cortex XSIAM console sees an endpoint in the 'Endpoints' inventory with a status of 'Disconnected'. The endpoint manager reports the Cortex XDR agent service is running, but the analyst wants to verify whether the agent is actually communicating with the tenant. Which action should the analyst take to confirm the agent's last communication time and connection state directly from the XSIAM console?

An analyst wants to iterate through a list of 50 IP addresses stored in the playbook context and run a enrichment command on each one individually. Which playbook feature should be used?

An analyst discovers that a threat intelligence feed is ingesting indicators with expiration dates far in the future, causing stale indicators to remain active. The analyst wants to enforce a maximum indicator lifespan of 30 days from the feed's own 'last_seen' field, regardless of what the source provides. Which setting in the Cortex XSIAM threat intelligence feed integration should be configured to achieve this?

A Cortex XSIAM analyst is validating an incoming TAXII 2.1 threat intelligence feed that keeps returning a 401 Unauthorized error during the 'Test' step of the feed configuration. The feed URL, collection ID, and API root are correct, and the same credentials work in a browser. What should the analyst verify first to resolve the failure?

An XSIAM analyst is handling an incident where an endpoint has been confirmed infected with ransomware. The analyst has already collected the ransom note and process execution logs as evidence. According to standard incident response procedures within XSIAM, what is the next appropriate action to prevent further encryption and lateral movement?

When designing robust error-handling workflows in XSIAM playbooks, which THREE strategies can be implemented to handle task failures gracefully? (Choose three)

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

While building a playbook in Cortex XSIAM, you need a task that waits for an analyst to approve a high-risk containment action before the playbook continues. The analyst may take several hours to respond. Which task type should you add to the playbook to satisfy this requirement?

A Cortex XSIAM analyst receives a threat intelligence indicator for a domain that is used by a business partner. The indicator is marked as malicious by an open-source feed, but the partner confirms the domain is legitimate. The analyst wants to ensure the domain does not trigger future incidents while keeping the feed enabled for other indicators. What should the analyst do?

Which TWO methods can be used to pass data between parent playbooks and sub-playbooks in XSIAM? (Choose two)

An analyst is reviewing an ASM finding in Cortex XSIAM that flags an external server as exposing an outdated TLS version. The analyst wants to confirm the exact endpoint, port, and certificate details associated with the finding before escalating to the infrastructure team. Where in Cortex XSIAM should the analyst look to view the detailed evidence for this specific ASM finding?

During a live incident, an analyst needs to pause a running XSIAM playbook before a destructive containment task executes, inspect the current task context, then resume execution from that exact point. Which playbook execution capability should the analyst use?

An analyst needs to create a custom analytic rule in XSIAM using XQL (XSIAM Query Language) to detect unusual PowerShell activity. Which section of the XSIAM platform should the analyst navigate to build and test this rule?

An XSIAM analyst is investigating an incident that contains multiple alerts. The analyst wants to determine the incident's overall severity score. Which TWO factors contribute to the calculation of an incident's severity score in XSIAM? (Choose two.)

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

When reviewing alert metrics and tuning detection rules in XSIAM, an analyst wants to identify noisy or low-value analytic rules. Which THREE metrics or views in XSIAM assist in evaluating alert rule effectiveness? (Choose three)

Which of the following best describes the purpose of 'analytic alert types' in XSIAM?

An analyst is reviewing XQL query results and notices that the 'actor_process_command_line' field contains long command-line strings that make the output difficult to read. The analyst wants to extract only the first 100 characters of this field into a new field named 'short_cmd' for easier triage. Which XQL stage and function should the analyst use?

An analyst notices that a high-severity threat intelligence indicator for a malicious domain is present in the XSIAM indicator repository but is not triggering any correlation rule matches against endpoint telemetry, even though several endpoints have resolved that domain. The indicator's expiration date is in the future and the feed that supplied it is enabled. What is the most likely cause?

While triaging an incoming security incident in XSIAM, an analyst observes multiple analytic alerts grouped together under a single incident container. What is the primary mechanism XSIAM uses to group these alerts?

An analyst is building a Cortex XSIAM correlation rule that uses a threat intelligence indicator set to tag matched events. They need to control how long an ingested indicator remains active before it stops producing matches, so stale indicators from a feed that stopped publishing new data do not keep generating alerts. Which indicator property should the analyst configure on the feed integration to achieve this?

A Cortex XSIAM analyst wants to create a playbook that automatically runs whenever a new high-severity incident is created. The analyst needs to select the appropriate trigger. Which trigger type should the analyst configure?

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

During an Attack Surface Management (ASM) review, an analyst needs to confirm which external-facing assets belonging to the organization have a specific known-vulnerable service version exposed. Where in Cortex XSIAM should the analyst look to see the discovered assets, their open ports, and detected service versions for the configured external IP ranges?

An analyst notices that a threat intelligence feed integration in Cortex XSIAM has been running for three days, but the Indicators view shows zero new indicators since the initial sync. The integration's health dashboard shows a green status and no error logs. Which action should the analyst take FIRST to determine why indicators are not appearing?

When reviewing an incident in the XSIAM Incident View, which TWO pieces of high-level summary information are immediately visible to an analyst? (Choose two)

When managing the incident lifecycle in XSIAM, an analyst determines that a triggered alert is a false positive and wants to prevent similar alerts from generating incidents in the future. What is the recommended action?

An XSIAM analyst is investigating a suspected credential dumping attack (e.g., LSASS memory dumping). Which THREE types of evidence or indicators should the analyst look for in XSIAM endpoint telemetry? (Choose three)

A playbook contains a script task that outputs a large JSON payload exceeding standard context size limits, causing performance degradation. What is the best practice to optimize context storage?

An analyst is reviewing the incident scoring for a newly created incident in XSIAM. The incident contains multiple alerts, including a high-severity alert and several low-severity alerts. The analyst notices that the incident score is higher than the score of the high-severity alert alone. What is the most likely explanation for this behavior?

When utilizing the 'compact' or 'dedup' commands in an XQL query, an analyst notices that certain fields are missing from the resulting dataset. Why does this behavior occur?

An XSIAM analyst is reviewing an incident where a suspicious binary was executed on a critical server. The analyst wants to determine the parent process that spawned the binary and the full command line used. Which XSIAM artifact or view should the analyst consult?

A SOC team wants its Cortex XSIAM playbooks to enrich and respond to incidents automatically without analyst intervention, but only for incidents that meet strict criteria. Which TWO capabilities allow a playbook to be triggered and controlled automatically based on incident attributes? (Choose two.)

An XSIAM analyst is investigating a malware incident where the endpoint has been isolated from the network. The analyst needs to retrieve a copy of a suspicious executable from the endpoint for further analysis in a sandbox. Which XSIAM capability should the analyst use to obtain the file?

An analyst is investigating an incident where a suspicious file was dropped on a host. To verify if other hosts across the enterprise have seen this exact file hash, which XSIAM search tool should the analyst use?

An analyst is configuring a custom prioritization rule in XSIAM to boost the incident score for alerts involving critical servers. The rule includes a condition matching a specific asset group. After saving, the analyst notices that alerts from those servers are still not receiving the elevated score. The rule's status is enabled. What is the most likely reason?

An XSIAM analyst is investigating a suspected data exfiltration incident. The analyst needs to identify all outbound connections from a specific endpoint to external IP addresses that transferred more than 100 MB of data in the last 24 hours. Which XQL query will achieve this?

An XSIAM analyst notices that a specific analytic alert has been triggering repeatedly for the same endpoint but with different timestamps. The analyst wants to group these related alerts into a single incident to streamline investigation. Which XSIAM feature should the analyst use?

Which feature enables playbooks to automatically execute on a recurring schedule (e.g., every morning at 2 AM) rather than reacting to an incident?

A security administrator wants to prevent end users from disabling the Cortex XDR agent through the endpoint's system tray or command line. Which setting should the administrator configure in the XSIAM agent policy?

A threat hunter is analyzing DNS activity in XSIAM using XQL. The hunter wants to identify domains that were queried by more than 50 unique endpoints within the last hour, as this could indicate a broad beaconing or DNS tunneling campaign. The hunter writes a query that groups DNS query events by the queried domain name and counts distinct source endpoints. Which TWO XQL components are required to correctly compute the number of unique endpoints per domain? (Choose two.)

An analyst is handling an incident in XSIAM where the same endpoint has generated three separate alerts for suspicious PowerShell activity over the past hour. The analyst wants to consolidate these related alerts into a single investigation view to avoid duplicate effort. Which XSIAM feature should the analyst use?

An XSIAM administrator is configuring a new custom prioritization rule to automatically escalate alerts related to a specific business-critical application. The administrator wants to ensure that alerts from this application are always assigned the highest severity. Which configuration element must be defined to target alerts from this application?

An XSIAM analyst notices that a custom analytic rule is generating alerts with a severity of 'Low' even though the rule's configuration specifies 'High' severity. The analyst confirms the rule is enabled and firing correctly. Which factor in XSIAM is most likely overriding the configured severity?

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

An analyst is building a playbook that must conditionally send an email notification only when the incident's severity is 'High' and the affected asset is marked as 'Production' in the CMDB. The CMDB lookup returns a JSON object. Which TWO approaches correctly implement this conditional logic within the Cortex XSIAM playbook? (Choose two.)

A Cortex XSIAM analyst wants a playbook to send a notification to a Slack channel only when the investigation finds at least one malicious file hash. The playbook already has a task that populates a list of malicious hashes in context. Which configuration should the analyst apply to the notification task?

An analyst wants to check the details of a specific security alert triggered on an endpoint, including the process tree and causality chain. Which XSIAM module contains the Causality Analysis View (CAV)?

An analyst is building an XQL query that pulls from a dataset with millions of events and must reduce the volume of data returned to the console while still preserving counts for reporting. Which TWO statements about XQL pipeline behavior are accurate in this scenario? (Choose two.)

A Cortex XSIAM analyst needs a playbook to pause and wait for a human reviewer to approve blocking a suspicious domain before the block task executes. The reviewer may also need to provide a justification note. Which TWO configurations are required to implement this human-in-the-loop step? (Choose two.)

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

When reviewing an incident in XSIAM, an analyst sees multiple related alerts grouped together. What is the term used in XSIAM for an individual security detection that contributes to an incident?

When evaluating alert prioritization in XSIAM, what does a higher alert score typically signify?

An organization's security policy requires that any threat intelligence indicator originating from an untrusted open-source feed must not automatically generate high-severity blocking alerts. How can this policy be enforced in XSIAM?

An administrator needs to manage endpoint security profiles in XSIAM. Which TWO types of prevention profiles can be configured and assigned to endpoints? (Choose two)

A security team wants to enforce endpoint security policy compliance across a fleet of Windows servers managed by Cortex XSIAM. The administrator plans to use policy rules that target endpoints based on specific attributes. Which TWO endpoint attributes can be used directly in a Cortex XSIAM endpoint policy rule to scope which endpoints receive the policy? (Choose two.)

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

A security analyst is configuring a new external attack surface scan in Cortex XSIAM. The analyst wants to ensure that the scan only targets IP addresses and domains that are explicitly owned by the organization, avoiding any third-party assets. Which configuration step should the analyst take to define the scope of the scan?

An administrator is preparing to enable the Cortex XDR agent's malware protection module on a set of Windows engineering workstations that run custom compiled binaries not seen elsewhere in the organization. The administrator wants to avoid disrupting legitimate builds while still catching malicious executables. Which approach best balances protection and operational continuity?

Which XQL command is used to rename a field in the output results dataset?

A Cortex XSIAM analyst needs a playbook to pause for a fixed period before checking whether an endpoint isolation command has completed, because the endpoint agent reports status asynchronously. Which playbook task should the analyst insert to introduce that fixed wait?

An organization wants to configure custom threat intelligence scoring in XSIAM. Which THREE factors can influence the composite threat score of an indicator within the platform? (Choose three)

An administrator is preparing a Cortex XDR agent upgrade for a group of Windows endpoints that must never lose malware protection during the update. The administrator wants the new agent package to be installed exactly once per endpoint without requiring a reboot, and wants the old agent removed only after the new agent is functioning. Which deployment method should the administrator use?

An XSIAM analyst is reviewing the Analytics page and observes that some alerts are marked as 'Incident-Bound' while others are not. The analyst needs to understand the implication of this designation for triage. What does it mean when an alert is labeled 'Incident-Bound' in XSIAM?

Which TWO actions can an analyst take within XSIAM to manage or respond to analytic alerts effectively? (Choose two)

A SOC manager wants to ensure that all alerts with a severity of 'Critical' are automatically assigned to the on-call analyst and that an incident is created immediately. The manager creates a custom prioritization rule that sets the severity to 'Critical' and assigns the incident to the on-call analyst. However, after testing, they notice that incidents are not being created for these alerts. What is the most likely cause of this issue?

An XSIAM Analyst is investigating a series of alerts related to a suspicious login from an unfamiliar IP address. The analyst wants to quickly see all alerts that share the same causality chain to understand the full scope of the activity. Which XSIAM feature provides this view directly from an alert?

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

An XSIAM analyst is reviewing a new high-severity incident and wants to see all the raw alerts, entities, and evidence that XSIAM automatically grouped together for this incident. Which part of the incident view should the analyst examine?

An XSIAM analyst receives an alert for a suspicious PowerShell execution on a finance department workstation. The analyst wants to quickly determine whether this alert is part of a larger incident or is an isolated event. Which XSIAM feature should the analyst use to view the alert's relationship to other alerts and incidents?

An analyst needs to ingest a commercial threat intelligence feed into Cortex XSIAM. The feed publishes indicators in a proprietary XML schema that no built-in integration supports, and the vendor provides only a REST endpoint returning that XML. What is the correct approach to make these indicators available in XSIAM?

An analyst is investigating a Windows endpoint that was recently compromised. The attacker used a legitimate signed driver to disable the Cortex XDR agent's kernel-mode protection. The analyst wants to prevent this technique from succeeding on other endpoints without blocking the legitimate business application that relies on the driver. Which XSIAM endpoint security capability should the analyst configure?

An analyst is investigating a Linux server where the Cortex XDR agent is installed but has not reported any events for several hours. The analyst confirms the agent process is running and the server has network connectivity. Which XSIAM feature should the analyst use first to verify whether the agent is properly registered and communicating with the tenant?

An enterprise requires continuous monitoring of endpoint security posture. Which TWO metrics or statuses are actively tracked in the XSIAM endpoint asset inventory? (Choose two)

An administrator manages a fleet of Windows endpoints in Cortex XSIAM. The security team wants to prevent end users from stopping the Cortex XDR agent service via the Services console, while still allowing administrators to uninstall the agent with a valid uninstall password. Which agent setting should the administrator enable?

An analyst needs to assign an unassigned incident to a specific Tier 2 response engineer within the XSIAM incident management interface. Which field must the analyst modify?

An XSIAM analyst is reviewing an incident that was automatically created by the platform. The incident details show that it was triggered by a correlation rule. The analyst wants to understand exactly which raw log entries matched the rule's criteria. Where can the analyst find this information?

A threat intelligence analyst in Cortex XSIAM notices that a specific indicator from a feed is causing a high number of false positive alerts in correlation rules. The analyst wants to prevent this indicator from triggering any future alerts without removing it from the threat intelligence database, as it may still be useful for historical context. What is the most appropriate action to take?

An analyst is reviewing a Cortex XSIAM threat intelligence indicator for a malicious domain and wants Cortex XSIAM to automatically expire the indicator after 30 days so that stale data does not trigger future correlation rules. The feed is delivered through a TIM-enabled integration that supports indicator expiration. Which setting should the analyst configure to achieve this?

A security team is using XSIAM to manage endpoint security across a mixed fleet of Windows and macOS devices. They need to ensure that the Cortex XDR agent enforces malware prevention and that endpoints can be isolated from the network if a threat is detected. Which two actions should the administrator take to meet these requirements? (Choose two.)

An analyst is building an XQL query to detect brute-force login attempts. The query must count failed login events per source IP within 10-minute windows and then filter for counts exceeding 20. Which two XQL commands or functions are essential to achieve this? (Choose two.)

A Cortex XSIAM analyst wants a playbook to automatically enrich every new high-severity incident with threat intelligence before any analyst reviews it. The enrichment must run without human interaction as soon as the incident is created. Which approach best satisfies this requirement?

An XSIAM analyst notices that a high-severity analytic alert was generated for a suspicious PowerShell command on a finance workstation, but no incident was created. The alert appears on the Analytics page with a status of 'New'. The analyst wants to ensure that future similar alerts automatically become incidents so they appear on the Incidents page for triage. Which configuration in XSIAM controls whether an analytic alert is promoted to an incident?

An administrator is configuring a new Cortex XDR agent installation on a group of macOS endpoints managed through Cortex XSIAM. The administrator needs to ensure the agent has the required macOS permissions to monitor and block malicious activity. Which TWO actions must be performed? (Choose two.)

When reviewing security events in the XSIAM Incident View, an analyst notices that an event has a 'BIOC' tag. What does BIOC stand for in the context of XSIAM and Cortex XDR?

A Cortex XSIAM analyst is tuning detection logic and needs to reduce noise from a threat intelligence indicator that repeatedly matches benign internal traffic. The analyst wants the indicator to remain available for enrichment but to stop generating detections. Which TWO actions should the analyst take to achieve this goal? (Choose two.)

What is the primary purpose of the 'Playbook Debugger' or test run feature when developing a new playbook in XSIAM?

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

An XSIAM analyst is investigating a series of alerts related to a potential data exfiltration attempt. The analyst notices that the same alert, 'Suspicious Outbound Connection', has fired multiple times over the past hour from the same source IP but with different destination IPs. The analyst wants to reduce noise while ensuring that a true exfiltration event is not missed. What is the most appropriate action according to XSIAM best practices?

An analyst notices that a specific Windows server's Cortex XDR agent is consuming unusually high CPU and the endpoint occasionally stops sending telemetry. The analyst suspects a scanning-related performance issue caused by the agent monitoring a large, rapidly changing data directory. Which action should the analyst take to reduce agent overhead while retaining threat detection elsewhere on the server?

An analyst is reviewing endpoint alerts in Cortex XSIAM and notices repeated 'Local Analysis' verdicts on a custom in-house application executable. The application is business-critical and the analyst wants to prevent future false-positive blocks without disabling malware protection globally. What is the most appropriate action?

An analyst is reviewing an endpoint's status in the XSIAM Endpoints page and sees that the Cortex XDR agent's status is 'Disconnected' while the endpoint itself is online and reachable over the network. The analyst confirms the endpoint has network connectivity to the XSIAM tenant. Which action should the analyst take FIRST to determine why the agent is not reporting?

Which TWO types of triggers can initiate a Cortex XSIAM playbook execution? (Choose two)

When configuring notification tasks within an XSIAM playbook, which THREE delivery methods or communication channels can be integrated natively? (Choose three)

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

An XSIAM analyst is leading the response to a confirmed ransomware outbreak. The incident was created automatically by the platform. The analyst needs to locate all affected endpoints and initiate remote live terminal sessions to contain the threat. Which area of the XSIAM console should the analyst use?

While troubleshooting a failed custom automation script inside a playbook, you notice that the script returned a non-standard error object. Where should you look first within XSIAM to inspect the raw inputs and outputs passed to the automation?

An XSIAM analyst is investigating an incident that was created from a 'Brute Force' analytic alert. The analyst notices that the incident's severity is 'High', but the individual alert's severity is 'Medium'. The analyst wants to understand why the incident severity is higher than the alert severity. Which XSIAM mechanism is responsible for this discrepancy?

You need to ensure that a specific playbook task executes only if the preceding task successfully found more than zero malicious hashes in the context. How should you configure the task condition?

What information does the MITRE ATT&CK matrix integration provide within XSIAM analytic alerts?

Which TWO actions can an analyst perform when managing incidents collectively using bulk actions in the XSIAM Incident Management interface? (Choose two)

A Cortex XSIAM playbook must process a list of suspicious IP addresses returned by an enrichment task. For each IP, the playbook should query a reputation service and record the verdict. The number of IPs varies per incident. Which XSIAM playbook construct should you use to iterate over the list and run the reputation query for each entry?

When writing a custom Python automation script to be executed as a Cortex XSIAM playbook task, which built-in library function is used to output results directly into the incident context?

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

An administrator is preparing to upgrade the Cortex XDR agent across a large fleet and wants the ability to revert endpoints to the previous agent version if the new build causes stability problems. Which capability should the administrator rely on in XSIAM?

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

A security administrator needs to confirm that a newly deployed Cortex XDR agent on a macOS endpoint is communicating with the Cortex XSIAM tenant and receiving policy updates. Which endpoint status indicator in the XSIAM console should the administrator check first?

A security analyst receives an alert that a Cortex XDR agent on a Windows server has not checked in with Cortex XSIAM for over 24 hours. The analyst wants to confirm whether the endpoint is still registered and view its last known status. Where in the XSIAM console should the analyst look?

When an analytic alert triggers in XSIAM, what role does confidence play in alert prioritization?

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

A Cortex XSIAM playbook must contain a task that only runs when the alert severity is Critical, while the surrounding tasks run for every incident. The analyst wants the playbook to skip that single task cleanly for non-critical incidents and continue with later tasks rather than stopping the branch. Which mechanism should be used?

An analyst is investigating a possible data exfiltration incident and needs to build an XQL query that detects a single source IP address making outbound connections to more than 20 distinct destination IP addresses within a 5-minute window. The analyst decides to use the `bin` command to group events into 5-minute buckets. Which command sequence correctly aggregates the data to identify the suspicious source IP?

An analyst is building a query to detect brute-force login attempts. The analyst wants to count failed logins per source IP within each 5-minute window and only surface IPs exceeding 10 failures. Which XQL construct is designed for this time-bucketed aggregation?

An XSIAM analyst is handling an incident that requires immediate containment of a malicious file hash across all endpoints. The analyst wants to automate this response for future similar incidents. Which XSIAM capability should the analyst use?

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

What is the purpose of tagging threat intelligence indicators in XSIAM?

A Cortex XSIAM analyst is designing a playbook that must run a remediation script on an endpoint. The script sometimes takes longer than the default task timeout, causing the playbook to fail prematurely. The analyst wants the playbook to wait for the script to complete without failing, while still allowing the playbook to proceed if the endpoint becomes unreachable. Which configuration should the analyst use?

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

An incident responder is investigating a ransomware outbreak. Which THREE immediate containment or remediation actions can be executed directly from XSIAM to mitigate the threat? (Choose three)

Which type of analytic alert in XSIAM focuses specifically on identifying unauthorized or anomalous credential usage?

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent installed successfully but the endpoint never appears in the XSIAM Endpoints inventory. The endpoint has internet access. Which two conditions should the administrator verify to resolve the missing registration? (Choose two.)

A Cortex XDR agent on a Linux server is repeatedly triggering behavioral threat protection alerts for a legitimate backup script that spawns shell commands and reads many files. The administrator wants to suppress these false positives without weakening protection against actual malicious behavior. Which action is most appropriate?

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

During an Attack Surface Management (ASM) review in Cortex XSIAM, an analyst sees an external-facing asset classified as 'Unregistered' even though the asset's IP address appears in a configured discovery scope. The analyst confirms the IP is reachable and the scan completed successfully. What is the MOST likely explanation for the classification?

An analyst notices that a Cortex XDR agent on a macOS endpoint is repeatedly disconnecting from the XSIAM tenant. The endpoint is behind a proxy that requires authentication. Which configuration should the analyst verify on the agent to ensure it can authenticate to the proxy and maintain connectivity?

An XSIAM analyst is responding to an incident involving a compromised endpoint. The analyst needs to isolate the endpoint from the network while preserving the ability to remotely investigate it. Which XSIAM action should the analyst perform?

An analyst is reviewing the endpoint security status in XSIAM and notices that a Linux server has the Cortex XDR agent installed but is reporting a 'Disconnected' status. The server is critical and runs a custom application that requires specific kernel modules. The analyst suspects that the agent is not functioning correctly due to a compatibility issue. Which of the following is the most appropriate first step to troubleshoot this issue?

Which THREE features are provided by the XQL search query interface in XSIAM to assist analysts during query authoring? (Choose three)

An XSIAM Analyst is investigating an analytic alert that has an unusually high priority score. The analyst wants to audit how the final score was calculated, specifically looking at the base score versus modifier weights. Where can the analyst inspect the score breakdown for an alert?

An administrator is designing a data ingestion pipeline in XSIAM. Which THREE data source categories can be ingested and normalized into XSIAM for security analytics? (Choose three)

An analyst is investigating a phishing campaign and needs to filter XQL results in the `xdr_data` dataset by a specific set of SHA256 hashes. The hashes are stored in the field `action_file_sha256`. Which XQL filter expression correctly returns only events where the hash matches any value in the provided array?

A Cortex XSIAM analyst is onboarding a new threat intelligence provider that publishes indicators at a very high rate. Shortly after enabling the feed, the analyst notices that indicator searches are slow and that several other feeds appear to have stopped updating. The platform's resource utilization is elevated. Which action best addresses the root cause while preserving intelligence coverage?

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

A security team wants a playbook to automatically trigger whenever a new high-severity incident is created by the analytics engine, without any analyst manually starting it. Which XSIAM mechanism should be configured to achieve this?

An analyst is hunting for encoded PowerShell activity and needs to match command lines containing base64-style strings. The analyst wants a case-insensitive regular expression match against the command_line field. Which XQL filter expression satisfies this?

An analyst receives an incident in XSIAM and wants to quickly gather more context about a suspicious file hash without leaving the incident view. Which action should the analyst take?

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

An administrator needs to prevent end users from stopping the Cortex XDR agent service on their Windows workstations. The administrator plans to enable password protection for the agent. Which statement correctly describes how password protection affects agent operations in Cortex XSIAM?

An analyst is troubleshooting a correlation rule that is failing to trigger incidents despite matching raw logs. Where can the analyst test and debug the rule logic against historical or sample log data in XSIAM?

A Cortex XSIAM analyst wants to review which external IP addresses and domains belong to the organization's internet-facing footprint after an ASM scan completes, so they can validate that no unexpected assets were discovered. Where does the analyst review the inventory of discovered external assets in XSIAM?

An XSIAM analyst is reviewing an incident that includes a 'Remote Process Execution' alert. To better understand the parent-child relationship and command-line arguments, the analyst opens the Causality View. Which feature in the Causality View allows the analyst to see the full command line and other process details for a specific process?

An analyst is investigating how XSIAM processes incoming analytic alerts and determines their initial lifecycle state. Which THREE characteristics or actions are associated with analytic alerts upon generation? (Choose three)

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

A Cortex XSIAM analyst is automating the triage of an alert that includes an IP address. The playbook must determine whether that IP is internal or external. The analyst wants to add a task that evaluates the IP and routes the playbook down the correct branch. Which task type in the Playbook Designer should the analyst use to evaluate the IP and produce a true or false result?

An XSIAM analyst is triaging a new incident that was created from a single high-severity analytic alert. The analyst wants to determine which specific detection rule generated the alert and what raw event data triggered it. Where should the analyst look within the incident view?

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

An analyst is performing forensics on a suspicious process execution in XSIAM. Which THREE artifacts or views are typically available in the Causality Analysis of an alert? (Choose three)

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

During an incident investigation, an analyst opens the Cortex XSIAM Threat Intelligence module and searches for an external IP address observed in the alert. The indicator detail view shows a 'Verdict' of 'Unknown' and no associated sources, even though several feed integrations are enabled and healthy. The analyst confirms the IP appears in logs but not in any indicator store. What is the most likely explanation for the missing verdict and sources?

A security administrator is configuring the Cortex XDR agent on a group of Windows servers. The organization's policy requires that the agent cannot be uninstalled by local administrators without a password. Which setting should the administrator configure to enforce this requirement?

An XSIAM analyst is reviewing an incident and wants to see the chronological sequence of events that led to the alert. Which XSIAM feature provides a timeline view of the incident's related activities?

An XSIAM analyst is reviewing a newly created incident that contains multiple alerts from the same endpoint. The analyst wants to determine which two conditions would cause the incident's severity to be recalculated automatically after a new alert is added. (Choose two.)

You are troubleshooting a Cortex XSIAM playbook that unexpectedly stopped executing after a script task returned an error. You want to understand how the playbook engine handles task-level errors so you can design more resilient flows. Which TWO statements accurately describe how task errors and playbook continuation behave in Cortex XSIAM? (Choose two.)

Which TWO objects or concepts are fundamental building blocks in a Cortex XSIAM playbook? (Choose two)

An analyst wants to examine the distribution of event severities in a dataset and display the count of events for each severity level. Which XQL command should the analyst use?

An analyst is reviewing endpoint security alerts and needs to filter events by specific threat categories. Which TWO threat categories are commonly associated with Cortex XDR endpoint prevention modules? (Choose two)

Which user role is typically required to create, edit, and publish custom playbooks in Cortex XSIAM?

A Cortex XSIAM analyst is preparing to ingest a third-party threat intelligence feed that provides indicators as STIX 2.1 objects. Before enabling the feed, the analyst wants to confirm that the platform can parse the format natively. Which statement best describes Cortex XSIAM's handling of STIX-formatted threat intelligence?

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

An analyst is writing a Cortex XSIAM playbook in which a task's output must be passed to a later task that sits on a different branch of the workflow. The later task cannot see the value because it is not a direct descendant of the producing task. What should the analyst do to make the value available where it is needed?

Which operator is used in XQL filter statements to check if a field value matches any item in a provided list?

An analyst wants to enrich an incident in Cortex XSIAM by correlating its associated IP addresses against the organization's active threat intelligence feeds. Which TWO actions will produce a list of matching indicators for those IPs? (Choose two.)

An XSIAM Analyst is reviewing the Alerts table after a phishing campaign. Several alerts reference the same host and user and share a common causality chain. The analyst wants to ensure these are treated as a single high-priority incident for the SOC team. Which XSIAM feature should the analyst rely on to automatically group these related analytic alerts into one incident?

A security manager asks an analyst to explain how Cortex XSIAM uses the Threat Intelligence module during alert triage. The analyst wants to describe the primary operational benefit correctly. Which statement best describes its role?

An XSIAM analyst is responding to an incident where an attacker moved laterally using remote service creation. The analyst wants to identify all endpoints where the attacker created a service with a specific suspicious binary path during the last 48 hours. Which approach best accomplishes this?

An administrator needs to verify that the Cortex XDR agent is installed and running on a specific Windows endpoint. The administrator has access to the XSIAM management console. Which section of the console should the administrator use to check the agent's status and version?

An XSIAM analyst is investigating a potential data exfiltration incident. The analyst wants to identify all endpoints that communicated with a specific suspicious external IP address (203.0.113.45) over the past 7 days. Which XQL query should the analyst use to retrieve this information from the network data?

An automation script requires secure storage of an API token used to query an external threat intel feed. Where should this token be stored within Cortex XSIAM?

A Cortex XSIAM playbook invokes a sub-playbook to perform malware analysis on an uploaded file. The sub-playbook can return a verdict of malicious, suspicious, or benign, and the parent playbook must take different response actions for each. How should the parent playbook consume the sub-playbook's result to drive those branching actions?

Where in the Cortex XSIAM web interface can an administrator view the graphical flowchart and execution status of a currently running playbook on an active incident?

An XSIAM administrator is configuring a new custom prioritization rule to escalate incidents involving critical servers. The administrator needs to define the rule's conditions and actions. Which TWO of the following are required components when creating a custom prioritization rule? (Choose two.)

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

A Cortex XSIAM playbook calls an external ticketing integration that returns HTTP 429 when the request rate exceeds the vendor's limit. The task currently fails and stops the playbook. The analyst wants the playbook to retry the call up to three times with increasing delay before marking the task as failed. Which configuration should the analyst apply to the task?

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

A Cortex XSIAM analyst is reviewing ASM findings for an external asset that exposes an outdated web framework. The asset is owned by a subsidiary that was acquired last quarter and is not listed in any existing discovery scope. The analyst wants ASM to start monitoring this subsidiary's domains and IP ranges automatically in future scans. What should the analyst do first?

An analyst is investigating an incident and needs to isolate an infected endpoint directly from the XSIAM Incident View. Which response action should the analyst execute?

A Cortex XSIAM analyst notices that a threat intelligence feed integration shows a status of 'Disconnected' and no new indicators have appeared in the indicator store for several hours. The feed uses an API key that the vendor recently rotated. What is the most likely cause and the appropriate first action?

When developing custom Python automation scripts for Cortex XSIAM, which THREE best practices should be followed for maintainability and performance? (Choose three)

A security analyst in Cortex XSIAM wants to enrich incoming alerts with context from an external threat intelligence source. The analyst needs the platform to automatically query the source and attach reputation and related indicators to matching alerts. Which Cortex XSIAM capability should the analyst configure to achieve this enrichment?

A Cortex XSIAM analyst is investigating a ransomware incident. The analyst needs to isolate an infected endpoint from the network to prevent lateral movement. Which action should the analyst take within the XSIAM incident response console?

A Cortex XSIAM Attack Surface Management scan has discovered an internet-facing server, but its hostname and open ports are recorded while the owning business unit and criticality are blank. The analyst wants subsequent ASM findings on this asset to be routed to the correct team and prioritized correctly. What should the analyst do to enrich the asset with ownership and criticality context?

A Cortex XSIAM analyst is building a playbook that must enrich an indicator by querying an external threat intelligence provider and then, based on the returned score, either close the incident or escalate it. The analyst wants to ensure the playbook can use the provider's response in later tasks. Which TWO actions should the analyst take when configuring the enrichment task? (Choose two.)

An administrator is deploying Cortex XDR agents to a set of Linux servers that run a custom application writing large log files to a non-standard mount point. The security team reports that the agent is generating excessive file scanning activity on those log files, impacting application performance. Which action should the administrator take?

A Cortex XSIAM playbook is triggered by a correlation rule that fires multiple times for the same incident within a short window. The playbook's first task creates a ticket in an external ITSM system, and duplicate tickets are being created. The analyst confirms that the correlation rule is correctly firing for distinct events but the playbook is running more than once per incident. Which setting should the analyst verify first to prevent duplicate playbook executions for the same incident?

An analyst is optimizing a slow-running XQL query in XSIAM. Which TWO best practices should be implemented to improve query performance? (Choose two)

An XSIAM analyst is investigating a series of alerts related to a suspicious PowerShell execution on multiple endpoints. The analyst wants to quickly identify all related alerts that share the same command-line argument across different incidents. Which XSIAM feature should the analyst use to achieve this?

When an analyst reviews an analytic alert in XSIAM, which THREE pieces of contextual information are typically available to assist in prioritization and triage? (Choose three)

Which TWO methods can be used to test a custom automation script before deploying it in a production playbook? (Choose two)

During a playbook run in Cortex XSIAM, an enrichment task that queries an external reputation service returns a large JSON object. A later task needs only the value of the 'reputation' field to decide whether to escalate. What is the most efficient way to make that value available to the later task?

A Cortex XSIAM playbook closes incidents automatically after containment. During testing, analysts notice that a playbook launched by one incident also modified a second, unrelated incident because a task output contained a stale incident ID from a previous run. Which playbook design principle should be applied to prevent this cross-incident contamination?

An XSIAM analyst is handling a critical ransomware incident. The analyst finishes containment, remediation, and verification, and wants to close the incident with the correct status so that reporting reflects a genuine security event that was resolved. Which incident status should the analyst select?

An analyst has just enabled a new threat intelligence feed in Cortex XSIAM and wants to quickly confirm whether indicators from that feed are actually being stored and are available for investigation, without waiting for a correlation rule to fire. Which action best accomplishes this?

An analyst is reviewing an Attack Surface Management scan that enumerated an external-facing host. The host is flagged with an unauthenticated remote code execution exposure tied to a specific product build, but the analyst needs to prioritize remediation based on whether the exposure is actively being exploited in the wild. Which XSIAM feature should the analyst consult to determine real-world exploitation status for this exposure?

A playbook loops over a list of forty endpoints and runs an isolation command on each. Midway through, the integration returns a rate-limit error on one endpoint. The team wants the playbook to log the failure for that endpoint and continue processing the remaining endpoints rather than aborting the entire run. Which configuration achieves this?

An administrator is preparing to deploy the Cortex XDR agent to a new batch of Windows endpoints. Before installation, the administrator wants to verify that the endpoints meet the minimum supported operating system requirements for the current agent version. Where in the Cortex XSIAM documentation or console should the administrator confirm the supported Windows versions?

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent fails to start after a system update. The administrator needs to collect diagnostic information to determine the cause. Which two actions can be performed from the XSIAM management console to assist with this troubleshooting? (Choose two.)

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

You notice that an automated playbook is executing multiple duplicate sub-tasks simultaneously because multiple alerts matching the same indicator arrived within seconds. How can you prevent race conditions or duplicate execution?

While reviewing a complex multi-stage attack in XSIAM, an analyst wants to visualize the sequence of process creation events on an endpoint. Which XSIAM feature provides a graphical representation of parent-child process relationships and associated network connections?

An analyst is tuning Cortex XSIAM Attack Surface Management (ASM) after a scan generated a large volume of findings, many of which are expected and low risk. The analyst wants to reduce noise so future scans surface only meaningful exposure. Which TWO actions are appropriate for this goal? (Choose two.)

An analyst is investigating an incident where an endpoint downloaded a suspicious file. Which TWO XSIAM tools or views can the analyst use to inspect the file's characteristics, hash, and reputation across the tenant? (Choose two)

During an investigation in Cortex XSIAM, an analyst needs to review the local protection settings currently applied to a specific Windows endpoint by its Cortex XDR agent, including whether behavioral threat protection is enabled and whether the agent is running in blocking or report-only mode. Where in the XSIAM console can the analyst view this per-endpoint protection configuration?

A Cortex XSIAM analyst is reviewing external attack surface findings and wants to reduce noise from ASM by focusing only on genuinely risky exposures. The analyst plans to use ASM finding attributes to filter and triage. Which TWO attributes are most useful for identifying externally exposed services that represent elevated risk and warrant immediate investigation? (Choose two.)

An XSIAM analyst is configuring a custom analytic rule to detect suspicious lateral movement using SMB. The analyst wants to ensure the rule generates alerts only when specific conditions are met. Which TWO components must be defined within the analytic rule to specify the detection logic and the data source? (Choose two.)

An XSIAM analyst is investigating an incident where a user's credentials were likely compromised. The analyst wants to gather evidence of potential credential misuse. Which TWO XSIAM data sources or views should the analyst examine? (Choose two.)

During an incident investigation, an analyst needs the playbook to fetch the reputation of every IP address observed in the alert and then act on the results. The number of IPs varies per alert, and the same enrichment and decision steps must run once for each address. Which XSIAM playbook construct should the analyst use to iterate over the dynamic list of IP addresses?

An analyst notices that a specific analytic is generating a high volume of false positive alerts. The analyst wants to reduce the noise without disabling the analytic entirely. Which XSIAM feature should the analyst use to suppress these alerts based on specific conditions?

Which THREE components or views in XSIAM assist analysts in recognizing and understanding analytic alert types and their context? (Choose three)

During an incident investigation in Cortex XSIAM, an analyst needs to determine the scope of a credential theft attack. The analyst wants to identify all endpoints where a specific compromised user account was used to log in successfully after the initial compromise. Which XQL query should the analyst run?

An analyst needs to share specific indicator of compromise (IOC) details discovered during an incident with an external ISAC. Which mechanism in XSIAM allows exporting or sharing threat indicators?

You need to format a raw JSON timestamp retrieved from an API call into a readable date string before displaying it in an incident layout. Which XSIAM playbook feature accomplishes this without custom Python code?

An analyst notices that an analytic alert is repeatedly firing for legitimate administrative activity (a false positive). Aside from custom prioritization, how can an analyst manage this specific alert instance to aid future investigations?

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

An XSIAM analyst is reviewing an incident where a user's credentials were used to access a sensitive server from an unusual geographic location. The analyst suspects the credentials were compromised. Which XSIAM feature should the analyst use to quickly determine if the user account has been involved in any other suspicious activities across the environment?

An XSIAM Analyst is configuring a new custom prioritization rule to ensure that alerts involving the finance department's servers receive a higher severity score. Which TWO elements must be defined within the rule for it to correctly match and score the intended alerts? (Choose two.)

A junior analyst is reviewing XQL query results and notices that the 'event_id' field is present in some rows but missing in others. They need to filter the results to only include rows where 'event_id' is not null. Which XQL filter condition should they use?

An analyst is reviewing an endpoint that has been flagged for suspicious behavior. The analyst wants to retrieve the agent's diagnostic logs directly from the XSIAM console to investigate why certain events were not detected. Which action should the analyst take?

An XSIAM analyst is investigating an incident and wants to add a note documenting the containment steps taken, so that other responders and auditors can see the actions in the incident timeline. Where should the analyst record this information?

An analyst needs to extract specific Regex matching patterns from an incoming email body during an automated phishing investigation playbook. Which built-in mechanism should be used?

An organization utilizes custom asset criticality tags in XSIAM. How does XSIAM incorporate asset criticality into the overall incident scoring process?

An analyst is examining an alert timeline in XSIAM. What does the timestamp on a security event represent?

A Cortex XSIAM administrator notices that an ASM scan completed successfully but a known external web application was not listed in the results. The application is reachable from the internet and is owned by the organization. Which troubleshooting step is most appropriate to determine why the asset was missed?

An administrator is configuring the Cortex XDR agent's self-protection settings to prevent tampering by malicious actors. The administrator wants to ensure that the agent cannot be stopped or uninstalled without proper authorization. Which TWO measures should the administrator implement? (Choose two.)

When analyzing security events in XSIAM, what are THREE key benefits of data normalization? (Choose three)

An automated playbook task fails intermittently due to a temporary network timeout when contacting an external asset management database. What is the most resilient way to handle this inside the playbook configuration?

A security team wants a Cortex XSIAM playbook to automatically isolate an endpoint whenever a malware alert with high confidence is ingested. They need the playbook to start without any analyst action. Which trigger type should be configured?

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

A Cortex XSIAM analyst is configuring an Attack Surface Management (ASM) discovery scope for a subsidiary and wants to ensure that only externally reachable assets are included in the inventory, excluding internal-only hosts. Which configuration should the analyst apply to the scope?

A threat intelligence administrator has ingested a feed of domain indicators into Cortex XSIAM. Several of those domains are legitimate business partners, and the administrator wants future correlation and detection logic to ignore them without deleting the indicators or disabling the entire feed. Which XSIAM mechanism should the administrator use?

Which TWO actions can be performed directly within the Cortex XSIAM Playbook Designer? (Choose two)

An analyst notices that a query joining two XQL datasets on a hostname field returns fewer rows than expected. Many hostnames in one dataset appear in uppercase while the other uses lowercase. Which XQL technique should the analyst apply to make the join match consistently?

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Which THREE factors are dynamically evaluated by XSIAM when calculating the default severity score of an analytic alert? (Choose three)

When designing a playbook, you want to assign an incident to a specific Tier 2 analyst group only if the alert severity is marked as 'High'. Which playbook element should you place before the assignment task?

An analyst reviews an analytic alert and notices its severity is classified as 'Medium', but wants to understand which specific sub-techniques triggered the detection. Where should the analyst look within the XSIAM interface?

A playbook designer needs to reference a specific value extracted from a previous task's output within Cortex XSIAM. Which syntax must be used to access this context data?

An XSIAM Analyst notices that a critical alert for 'Malicious PowerShell Execution' was generated but never appeared in the Incidents table. The alert is visible in the Alerts table with a status of 'Under Investigation'. Which XSIAM behavior explains why this alert has not become an incident?

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

An analyst is investigating an incident where an attacker attempted to clear Windows Event Logs to hide malicious activity. Which XSIAM behavioral detection category typically flags this suspicious administrative tampering?

An XSIAM analyst is investigating a false positive alert that repeatedly triggers for a legitimate administrative script. The analyst wants to prevent future alerts from this specific script without disabling the entire analytic rule. Which XSIAM feature should the analyst use to suppress alerts based on specific criteria?

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

A security analyst is investigating a potential data exfiltration incident. They need to identify all unique destination IP addresses that received more than 100 MB of outbound traffic from any internal host during the last 24 hours, and then display the total bytes sent to each of those IPs. The relevant network traffic data is stored in the 'xdr_data' dataset with fields 'action_local_ip', 'action_remote_ip', and 'action_remote_bytes'. Which XQL query correctly produces the required result?

An analyst is triaging an alert in Cortex XSIAM where an internal host contacted an external IP address that appears in multiple threat intelligence feeds. The analyst wants to determine, within the platform, why the indicator is considered malicious and how it relates to known campaigns. Which TWO actions help the analyst understand the indicator's context and provenance? (Choose two.)

When configuring a manual task in a playbook that requires an analyst to approve or reject a host isolation action, which element defines the available response buttons?

A Cortex XSIAM analyst is building a playbook that must pause and wait for an analyst to review a quarantined file before deciding whether to restore or delete it. The playbook should resume automatically once the analyst completes the review task. Which task type should the analyst use to implement this pause and resume behavior?

A threat hunter is analyzing authentication logs in XSIAM using XQL. They want to identify potential brute-force attacks by finding source IP addresses that have more than 10 failed login attempts within a 5-minute window. The logs are in the 'auth_logs' dataset with fields 'src_ip', 'event_time', and 'status' (where 'status' is either 'success' or 'failure'). Which two XQL stages or functions are essential to achieve this? (Choose two.)

An analyst needs to filter the Incident Queue to display only incidents that contain specific high-priority analytic alert types. Which filtering mechanism should the analyst use in the XSIAM Incident view?

Which TWO information sources or artifacts can an analyst inspect within an XSIAM incident to understand the scope of an attack? (Choose two)

Which TWO actions occur when a playbook task hits a conditional split with multiple matching paths? (Choose two)

Which TWO components are fundamental parts of every XQL query structure? (Choose two)

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

An organization wants to reduce noise from a known vulnerability scanner that triggers high-severity analytics alerts every weekend. The SOC decides to suppress these specific alerts during scanning windows. How should the analyst configure this in XSIAM?

An analyst is handling an incident in XSIAM where the attacker moved laterally from a compromised workstation to a server. The analyst wants to identify all affected endpoints and their current containment status from a single view. Which XSIAM feature should the analyst use?

An XSIAM administrator is designing a custom prioritization rule to ensure that alerts involving critical servers are escalated. Which TWO components must be defined within the rule for it to correctly evaluate and apply prioritization? (Choose two.)

During an investigation, an analyst identifies an external IP address communicating with multiple internal hosts. To gather threat intelligence context on this IP address directly within XSIAM, which feature should the analyst inspect?

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

Which THREE characteristics describe XSIAM analytic alerts versus standard log queries? (Choose three)

An analyst is responding to an incident involving a compromised user account in XSIAM. The analyst needs to contain the threat and prevent further unauthorized access. Which TWO actions should the analyst take? (Choose two.)

An XSIAM analyst is reviewing the Alerts table and wants to quickly identify which alerts are associated with a specific incident. Which column or field in the Alerts table should the analyst use to filter for alerts that are part of an incident?

An analyst investigates a suspected lateral-movement burst and needs to identify source hosts that connected to more than 15 distinct destination IPs within a single hour. The relevant authentication events are already filtered into the pipeline. Which XQL construction produces one row per source host per hour with the distinct destination count?

A security analyst is handling a new incident in Cortex XSIAM. The incident contains a high-severity alert for 'Suspicious PowerShell Execution' on host FIN-PC-07. The analyst wants to quickly determine the parent process of the PowerShell instance to understand how it was launched. Which XSIAM feature should the analyst use?

A Cortex XSIAM playbook includes a task that sends an HTTP request to an external enrichment service. The analyst wants to prevent the playbook from exposing the API key in the task inputs and wants the key to be managed centrally so it can be rotated without editing the playbook. Which two actions should the analyst take? (Choose two.)

An XSIAM analyst is responding to a confirmed malware incident on an endpoint. The analyst needs to immediately isolate the endpoint from the network to prevent further spread. Which XSIAM action should the analyst take?

An analyst is reviewing the XSIAM Analytics page and notices that a specific analytic alert has a status of 'Under Investigation' but is not linked to any incident. The analyst wants to understand why this alert is not appearing in the Incidents view. What is the most likely reason for this behavior?

An analyst is reviewing the results of an Attack Surface Management scan in Cortex XSIAM and sees a finding for an exposed service on a non-standard port. The analyst wants to understand the potential risk and remediation steps. Where can the analyst find detailed information about this finding, including the service banner and recommended actions?

An analyst wants to classify network events into risk buckets based on the numeric field `bytes_out`: under 1 MB is 'low', 1 MB to 100 MB is 'medium', and above 100 MB is 'high'. The classification should be added as a new field in the pipeline without removing existing fields. Which approach accomplishes this in XQL?

An analyst is designing a Cortex XSIAM playbook that must pass data between tasks without relying on ad hoc string parsing. Which TWO methods allow a downstream task to consume the output of an upstream task? (Choose two.)

A threat hunter wants to detect beaconing by finding source-destination pairs whose connection count is unusually high within a one-hour window. The analyst groups events by source IP, destination IP, and a one-hour time bucket, then counts connections. Which XQL feature supports creating that one-hour time bucket for grouping?

An analyst needs to export a detailed report of all closed incidents over the last 30 days for an executive summary. Where can this report generation be initiated within XSIAM?

What is the primary difference between an 'analytic alert' and an 'XQL correlation alert' in XSIAM?

An XSIAM Analyst is reviewing the Incident Management dashboard and needs to understand why a specific high-severity incident was automatically merged with an existing one. Which XSIAM feature determines this grouping behavior?

When reviewing query performance in XSIAM, what does the 'dataset' command do at the beginning of an XQL query?

An analyst observes that two distinct analytic alerts—one for 'Suspicious Process' and one for 'Outbound Connection'—are generated 10 minutes apart on the same host. In XSIAM, how are these related alerts typically presented to the analyst?

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

An analyst is investigating an incident in XSIAM where a single high-severity alert was generated, but the incident detail view shows three related alerts grouped together. The analyst needs to determine why these alerts were correlated into one incident rather than appearing as separate incidents. Which XSIAM mechanism is responsible for automatically grouping related alerts into a single incident?

An analyst is building a Cortex XSIAM playbook that must run an enrichment task only when the incident's severity is 'Critical' AND the source IP is external. The playbook already has a task that retrieves severity and IP classification. Which playbook construct should the analyst use to evaluate both conditions before proceeding?

An XSIAM analyst is investigating an analytic alert triggered by a rare process execution. The analyst wants to see if similar processes have executed across other endpoints in the enterprise over the past 30 days. Which action should the analyst take?

An analyst is investigating a Windows endpoint that has a Cortex XDR agent installed. The endpoint's security team reports that the agent is still running and reporting to XSIAM, but endpoint protection features such as malware prevention and exploit protection are not blocking malicious activity. The analyst checks the endpoint status in the XSIAM console and sees that the agent is in a 'Disabled' state. Which action should the analyst take to re-enable the agent's protection features?

An analyst is building a Cortex XSIAM playbook that must enrich every newly created high-severity incident with asset owner data. The enrichment task must run only when the incident's asset is present in the CMDB; otherwise, the playbook should skip enrichment and continue to the notification task. Which XSIAM construct should the analyst configure immediately after the 'Get Asset' task?

An analyst is building a query to detect abnormal process behavior. They want to calculate the ratio of network connections to process executions for each process name, but only for processes that have at least 5 executions. The relevant events are in the 'xdr_data' dataset with an 'event_type' field indicating 'process' or 'network'. Which XQL query correctly computes this ratio?

An analyst is building a Cortex XSIAM playbook that must query a threat intelligence platform for each of several indicators. The query task sometimes fails with a transient network timeout, but succeeds when retried a few seconds later. The analyst wants the playbook to automatically retry the task up to three times before continuing to the next task. Which playbook task configuration should the analyst use?

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Which XSIAM construct allows you to package a reusable set of playbook tasks into a modular component that can be invoked by multiple parent playbooks?

A playbook is designed to isolate an endpoint when a malware incident is detected. The isolation task occasionally fails because the endpoint is offline. The analyst wants the playbook to continue processing other tasks and record the failure for later review instead of stopping the entire playbook. Which playbook task configuration should the analyst apply?

A security operations team wants Cortex XSIAM to continuously discover internet-facing assets belonging to their organization without manually supplying individual hostnames each time a new subsidiary is onboarded. Which ASM capability should they configure to achieve ongoing discovery from a broad organizational identifier?

An XSIAM analyst notices that a specific analytic alert, generated by a built-in analytics rule, has been automatically assigned a high severity score that seems inconsistent with the raw event data. The analyst wants to understand what factors could have contributed to this elevated severity. Which of the following is the most likely explanation for the elevated severity score?

An analyst investigating a phishing alert wants to confirm whether a domain seen in the email headers is associated with known malicious activity. The domain does not appear in any enabled feed. Which Cortex XSIAM capability allows the analyst to check the domain's reputation and enrich the investigation without leaving the platform?

An XSIAM Analyst is reviewing the Analytics page and needs to understand the difference between standard alerts and incident-bound alerts. Which of the following best describes the role of analytics in XSIAM's alerting process?

You need to export a custom playbook from your development XSIAM tenant and import it into your production XSIAM tenant. What is the standard packaging format used?