An enterprise environment has deployed multiple Cortex XDR agents across diverse operating systems. The administrator wants to organize endpoints logically within XSIAM before assigning granular security policies. Which Cortex XSIAM feature should be used to dynamically group these endpoints based on criteria such as OS version, domain, or IP subnet?
Trap 1: Asset Tags
Asset tags are metadata labels applied to entities for filtering and search purposes, not primary operational groupings for policy inheritance.
Trap 2: Data Filters
Data filters are applied to log ingestion streams to control parsing and storage quotas, not endpoint management.
Trap 3: Correlation Rules
Correlation rules are analytical logic constructs used to detect security threats, not administrative grouping mechanisms.
- A
Asset Tags
Why it fails: Asset tags are metadata labels applied to entities for filtering and search purposes, not primary operational groupings for policy inheritance.
- B
Data Filters
Why it fails: Data filters are applied to log ingestion streams to control parsing and storage quotas, not endpoint management.
- C
Endpoint Groups
Endpoint Groups dynamically evaluate membership criteria such as OS version, domain, or IP subnet, so endpoints are organised logically before policy assignment. This satisfies the requirement to group diverse Cortex XDR agents automatically rather than manually, enabling granular policy targeting across the estate.
- D
Correlation Rules
Why it fails: Correlation rules are analytical logic constructs used to detect security threats, not administrative grouping mechanisms.