Select Two (Multi-Select) Questions

License renewal expiration tracker

Why it fails: License renewal expiration tracking concerns contract administration, not analytic alert triage. It is tempting because XSIAM does surface licence and ingestion usage data, but that belongs to administrative dashboards; recognising alert types and their context requires the analytics, detection-rule and case views instead.

Agent BIOS version audit report

Why it fails: BIOS version auditing concerns endpoint firmware inventory, not analytic alert types or their context. It is tempting because XSIAM does surface endpoint asset data, but that view supports compliance and vulnerability reporting rather than helping analysts recognise alert categories, their severity or the telemetry that triggered them.

Bluetooth Low Energy beacon frames

Why it fails: Bluetooth Low Energy beacon frames are short-range advertising packets, not a threat intelligence feed transport, so XSIAM cannot natively import them. It is tempting because BLE is used for proximity and asset tracking, and would be correct for indoor location telemetry rather than indicator feed ingestion.

Proprietary printer configuration protocols

Why it fails: Proprietary printer configuration protocols carry device settings, not structured threat indicators, so XSIAM has no native feed import support for them. It is tempting because printers are networked endpoints, and such protocols would be correct for managing print device configuration rather than threat intelligence ingestion.

Raw binary kernel dump files

Why it fails: Raw binary kernel dump files are memory forensic artefacts, not a threat intelligence feed protocol or format, so XSIAM cannot natively ingest them as feeds. It is tempting because kernel dumps carry compromise evidence, and would be correct for endpoint forensic triage rather than intelligence feed import.

A schedule that defines when the rule is active

Why it fails: While some rules may have schedules, custom prioritization rules in XSIAM do not require a schedule to function. The core requirement is a condition and an action. Adding a schedule is optional and not necessary for the rule to match and score alerts correctly.

A notification template to alert the SOC team

Why it fails: Notification templates are used for communication, not for prioritization logic. They do not affect how alerts are matched or scored. Including a notification template is unnecessary for the rule's core function of adjusting severity based on asset attributes.

An incident grouping rule reference to link related alerts

Why it fails: Incident grouping rules are separate from prioritization rules. Prioritization focuses on scoring individual alerts, not grouping them. Referencing a grouping rule is irrelevant and does not contribute to the matching or scoring logic of a prioritization rule.

Configure the agent to scan for and remove other security tools that might conflict.

Why it fails: Removing conflicting security tools is not a self-protection feature and could cause system instability. This action is unrelated to preventing tampering with the Cortex XDR agent itself. In fact, such behavior could be seen as aggressive and may violate organizational policies. It does not contribute to the agent's ability to resist being stopped or uninstalled.

Set the agent to automatically update to the latest version without user intervention.

Why it fails: Automatic updates ensure the agent has the latest features and security patches, but they do not directly prevent tampering or unauthorized uninstallation. While keeping the agent current is a best practice, it does not address the requirement to stop malicious actors from disabling the agent. This option is more about maintenance than self-protection.

Enable detailed logging of all agent actions to a remote syslog server.

Why it fails: Remote logging helps with auditing and forensic analysis but does not prevent an attacker from stopping or uninstalling the agent. It can provide evidence after an attack, but it is not a preventive control. The requirement is to prevent tampering, not just to record it. Therefore, this measure alone does not meet the self-protection goal.

Every retrieved indicator is immediately pushed to all managed endpoint agents as a blocklist entry.

Why it fails: Feed ingestion does not automatically distribute indicators to endpoint agents as blocklist entries. Blocking requires explicit configuration through the relevant enforcement mechanism, not the feed poll itself. This distractor overstates the effect of ingestion by assuming automatic endpoint enforcement, which is a separate and deliberate action.

Newly retrieved indicators are automatically written into every enabled correlation rule's indicator filter without analyst action.

Why it fails: Correlation rules reference indicator types and reputations, not individual indicators; they query the repository at evaluation time rather than embedding specific indicators. New indicators therefore become matchable through their type and reputation, not by being inserted into rule filters. Automatic per-indicator rule modification is not how XSIAM correlation works.

Retrieved indicators are quarantined in a staging area and require manual approval before they become visible to any XSIAM component.

Why it fails: Indicators from enabled feeds are stored directly in the repository and are immediately available for correlation and enrichment; there is no mandatory quarantine-and-approval gate for all incoming indicators. While exclusion lists and false-positive handling exist, they are not a universal staging requirement. This option invents a workflow that would defeat the purpose of automated ingestion.

Write custom XQL queries for data ingestion pipelines.

Why it fails: XQL queries are authored in the Query Center or data model editor, not the Playbook Designer, which orchestrates automated response tasks. Writing queries is tempting because XSIAM analytics depend on XQL, but ingestion pipeline queries are configured outside playbook authoring.

Modify global firewall routing tables.

Why it fails: Firewall routing tables are modified on the firewall or network device itself; the Playbook Designer only orchestrates response actions through integrations. Routing changes are tempting because playbooks can trigger remediation, but they act via API integrations, not by editing global routing tables directly.

Install local endpoint security agents.

Why it fails: Endpoint agent installation is performed by the endpoint management or deployment tooling, not the Playbook Designer, which invokes actions on already-managed endpoints. Installing agents is tempting because playbooks remediate endpoints, but deployment of the agent itself sits outside playbook authoring.

Endpoint agent installation package version

Why it fails: An endpoint agent package version governs local endpoint protection content, not the credentials and endpoint URL an API feed needs. It is tempting because agent versions matter elsewhere in Cortex XSIAM, and would be the correct parameter when enrolling or upgrading endpoint agents rather than configuring threat intelligence ingestion.

Active Directory Domain Controller IP address

Why it fails: A domain controller IP address supports identity collection and agent deployment, not outbound API polling of an external intelligence provider. It is tempting because Cortex XSIAM integrates with Microsoft Entra ID and on-premises directories, and would be correct when configuring identity-based data sources or user risk enrichment.

Syslog facility number

Why it fails: Syslog facility numbers classify messages arriving over syslog, whereas API-based ingestion pulls structured data over HTTPS with credentials. It is tempting because syslog parsing is configured for many log sources, and would be correct when onboarding a device that forwards events via syslog rather than an API.

sort by event_time desc

Why it fails: Sorting by event_time descending orders the events from newest to oldest, which can be useful for display but is not essential for detecting brute-force patterns. The detection relies on counting failures within time windows, which can be done regardless of sort order. While sorting might help in subsequent stages, it does not contribute to the core logic of grouping and counting. Therefore, it is not one of the essential stages.

join with a threat intelligence dataset on src_ip

Why it fails: Joining with a threat intelligence dataset could enrich the results by adding reputation data, but it is not essential for the core brute-force detection. The requirement is to identify IPs with many failures in a short time, which can be accomplished without external data. While enrichment is valuable for prioritization, it is not a necessary step to compute the counts and apply the threshold. Thus, it is not one of the essential stages.

dedup src_ip

Why it fails: The dedup stage removes duplicate records based on specified fields, keeping only one event per unique value. If you dedup by src_ip, you would collapse all events from the same IP into a single row, losing the individual failure events needed for counting. This would completely defeat the purpose of counting multiple failures per IP. Therefore, dedup is not only non-essential but would break the detection.

The local cafeteria lunch menu for the day

Why it fails: A cafeteria menu is unrelated operational data containing nothing about hosts, identities or network activity, so it cannot establish attack scope. It is tempting only because XSIAM correlates numerous enterprise data sources, yet useful artefacts must be security telemetry such as endpoint events, alerts or observables tied to the incident.

Office printer paper inventory levels

Why it fails: Paper inventory levels are physical logistics data with no telemetry link to hosts, accounts or network flows, so they cannot reveal attack scope. It is tempting because XSIAM ingests many third-party data sources, but only security-relevant artefacts such as endpoint telemetry, alerts or file hashes expose affected assets.

Employee parking garage badge swipe records outside XSIAM

Why it fails: Badge swipe records sit outside XSIAM and describe physical access, not the cyber artefacts — process trees, network connections, authentication events — needed to scope an intrusion. Physical access logs would be relevant to a facility-security investigation, but they cannot enumerate compromised endpoints or accounts here.

The entire XSIAM tenant automatically shuts down for maintenance.

Why it fails: Branch evaluation only determines which subsequent tasks execute; it cannot shut down the XSIAM tenant. Tenant-wide maintenance is an administrative platform operation, so this option confuses playbook control flow with infrastructure lifecycle management and would never occur automatically from a split.

The browser cache of every user is cleared.

Why it fails: A conditional split evaluates task conditions and selects matching paths; it has no mechanism to reach endpoint browsers and clear their caches. Browser cache clearing is an endpoint remediation action performed by agent-based response, not by server-side playbook branching logic.

All system logs are permanently purged from disk.

Why it fails: Conditional splits route playbook execution down matching branches; they never purge system logs from disk. Log retention is governed by separate data-management and retention policies, so this action is irrelevant to branch evaluation and would only be configured deliberately for storage lifecycle purposes.

A SQL SELECT statement header

Why it fails: XQL uses a pipe-based pipeline syntax, not SQL's SELECT header, so this clause cannot form part of a valid query. It is tempting because XQL resembles SQL in filtering and aggregation, and a SELECT statement would be the right starting construct when querying a relational database rather than Cortex XSIAM datasets.

An automated playbook trigger reference

Why it fails: XQL queries are built from a dataset selection and a stage pipeline; playbook triggers are automation constructs invoked after detection, not query syntax. It is tempting because playbooks consume query output, but a playbook trigger reference would be correct when defining automated response actions rather than authoring a query.

A mandatory XML schema declaration

Why it fails: XQL is a piped query language operating on datasets and stages; it requires no XML schema declaration, and no XML is parsed at query time. It is tempting because schema validation appears in other data tooling, but an XML schema declaration would be correct when validating structured XML payloads, not writing XQL.

Manual USB drive file transfer

Why it fails: Playbook data transfer occurs inside the XSIAM execution context, so no physical media is involved. USB transfer suits air-gapped systems moving files manually, whereas parent and sub-playbooks exchange structured inputs and outputs automatically during a single automated run.

Direct hardware memory pointers

Why it fails: XSIAM playbooks are abstracted automation workflows; they cannot address raw memory pointers, which belong to native code debugging. Pointer manipulation would be relevant when instrumenting a process directly, not when passing structured inputs and outputs between parent and sub-playbooks.

Hardcoding variables in system environment files

Why it fails: XSIAM passes data between parent and sub-playbooks through defined inputs, outputs and context keys, which environment files cannot supply per-execution. Hardcoded environment variables suit static configuration shared across playbooks, not dynamic values returned from a specific sub-playbook run.

Block the user's IP address at the firewall

Why it fails: Blocking the user's IP address at the firewall may not be effective if the attacker is using a different IP or if the user's IP is dynamic. It can also block legitimate traffic if the IP is shared. This action is not specific to the compromised account and may not contain the threat effectively.

Delete the user account

Why it fails: Deleting the user account is a drastic action that can cause loss of audit trails and may disrupt business operations. It is not a standard containment step; disabling is preferred. Deletion should only be considered after a thorough investigation and according to policy, not as an immediate response.

Reset the user's password

Why it fails: Resetting the password alone does not immediately terminate active sessions or prevent the attacker from using existing tokens or cached credentials. While it is a good remediation step, it is not sufficient for immediate containment. Disabling the account is a stronger and more immediate action.

Modify firewall hardware routing tables

Why it fails: XSIAM's Threat Intelligence workspace lets analysts edit indicator metadata, tags and verdicts, not network device configuration. Firewall routing tables sit outside the platform entirely. It is tempting because indicators do drive blocking, but that enforcement happens through integrated response actions or the firewall's own management console, not by editing routing entries here.

Reflash the BIOS firmware of endpoints matching the indicator

Why it fails: The Threat Intelligence workspace supports indicator actions such as tagging, adding to allowlists or blocklists, and pivoting to related incidents; BIOS reflashing is an endpoint remediation task performed elsewhere. It tempts because indicators drive response, but firmware updates are not an indicator-level operation.

Directly update global cloud provider DNS records

Why it fails: Analysts can enrich, tag or add indicators to blocklists within XSIAM, but editing global DNS records at cloud providers is outside the platform's indicator actions. It tempts because blocking malicious domains is a response goal, yet DNS changes belong to provider consoles or DNS security tooling.

Compiling the script into a native Windows executable (.exe) on a local laptop

Why it fails: Compiling to a Windows executable tests nothing about the script's behaviour inside the playbook runtime, and the automation platform executes its own language interpreter rather than native binaries. It tempts because local compilation catches syntax errors, which would be correct for a standalone desktop program, not a playbook script.

Broadcasting the script over local radio frequencies

Why it fails: Radio broadcast transmits the script but executes nothing, so no syntax, runtime or logic errors surface before production. It tempts as an analogy to distributing code to test machines, and radio would be correct for one-way telemetry or emergency communications, not for validating automation logic.

Printing the script on paper for manual peer review

Why it fails: Printing a script produces no execution, so syntax errors, runtime exceptions and logic faults remain undetected before deployment. It tempts as a cheap review step, and peer review of printed code is legitimate for style or logic inspection, but it cannot satisfy a requirement to test script behaviour.

Local printer driver version installed on the analyst's laptop

Why it fails: A printer driver version on the analyst's own laptop has no bearing on the alert's severity, affected asset or threat context, so it cannot aid triage. It is tempting because endpoint inventory data is genuinely useful, but only when the endpoint in question is the one named in the alert.

Cafeteria menu schedule for the security operations center

Why it fails: A cafeteria schedule is unrelated to the alert's host, user, process or network indicators, so it contributes nothing to prioritisation. It is tempting because SOC operational logistics are sometimes surfaced in dashboards, but such content belongs to facilities planning, not to analytic alert triage context.

Primary domain controller NetBIOS name

Why it fails: The NetBIOS name identifies a Windows domain controller for legacy name resolution; it plays no part in proxy authentication or traversal. It is tempting because it is a real Windows networking value, and would be correct when joining a host to a domain rather than configuring an agent's proxy connection.

Local BGP autonomous system number (ASN)

Why it fails: BGP ASN is a routing protocol identifier exchanged between autonomous systems; the agent never uses it to reach a proxy. It is tempting because it is a genuine network parameter, and would be correct when configuring dynamic routing between network segments rather than endpoint proxy traversal.

Increases local storage capacity on the log collector

Why it fails: Normalisation parses and maps raw fields into a common schema for correlation, not storage provisioning; collector disk capacity is governed by retention and volume settings. It is tempting because normalised events are more compact, but the benefit is searchable consistency, not added capacity.

Automatically encrypts hard drives on all endpoints

Why it fails: Incorrect. Encryption is handled by endpoint security agents/policies, not data normalization.

Automated AM/FM radio broadcast

Why it fails: XSIAM's native notification channels are email and integration-based messaging such as Slack or webhooks; AM/FM radio broadcast is not a supported alerting mechanism. It is tempting because broadcast reaches many people simultaneously, and would be correct where an organisation operates its own radio dispatch system integrated with the platform.

Physical office alarm siren activation

Why it fails: XSIAM notifies analysts through digital channels such as email and integration-based messaging; activating a physical office siren is not a platform notification channel. It is tempting because audible alarms suit on-site security operations, and would be correct where a separate physical alarm system is wired to trigger on incidents.

Direct SMS text messaging via cellular gateway without integrations

Why it fails: XSIAM's native notification channels are email and integrations such as Slack or webhooks; direct SMS via a cellular gateway requires an external integration, so it is not natively supported. It is tempting because SMS is a familiar analyst alerting method, and would be correct where an SMS gateway integration has been configured.

Reconfigure physical office door security locks

Why it fails: XSIAM orchestrates endpoint, identity, and network response actions; physical door locks sit outside its integration surface. It is tempting because containment can include facility lockdown, but that belongs to a physical security system, whereas XSIAM would isolate endpoints or disable accounts.

Physically replace damaged motherboard hardware on endpoints

Why it fails: Motherboard replacement is a hardware repair task performed by field technicians, not an action XSIAM can dispatch. It is tempting because ransomware remediation sometimes requires rebuilding compromised machines, but XSIAM's role is software containment such as isolating the endpoint or killing processes.