POST TEST CORTEX XDR

Which license is required to import external logs from different vendors?

• Cortex XDR Pro per Endpoint

• Cortex XDR Vendor Pro Per Host

• Cortex XDR Pro Per TB

• Cortex XDR Cloud Per Host

When viewing events directly, what is the value of the 'assigned to' field for a new event just reported to Cortex?

• New

• New Incident

• Unassigned

• Pending

In incident-related widgets, how would you filter the display to only show incidents that were “starred”?

• Create a custom XQL widget

• Click the star in the widget

• This is not currently supported

• Create a custom report and filter on starred incidents

Where would you view the WildFire report in an incident?

• In the WildFire Analysis report at related Artifacts in the incidents details page

• Under Response --> Action Center

• under the gear icon --> Agent Audit Logs

• on the HUB page at apps paloaltonetwork

What are the three actions available from the Cortex XDR interface?

• Dashboard & Reports

• Endpoint

• Alert

• Incident Response

What is the function of the Action Center?

• This is used to create a profiles and policy rules

• This is used to track progress of all actions initiated from various points on the interface.

• This is used to view a causality chain

• This is used to manage an incident

False or True: Cortex XDR supports two types of rules, namely IOC and BIOC rules.

• TRUE

• FALSE

Cortex XDR establishes live terminal sessions with endpoints in two ways:

• Action Center -> New action -> Live Terminal

• via Endpoint -> Security Operation -> Initiate Live Terminal

• via SSH connection

Choose three logs that can be forwarded by cortex xdr

• Alerts

• Management Audit Log

• Agent Audit Log

• Threat Log

Where can I get the installer for the Cortex XDR Agent?

• HUB paloaltonetworks.com

• Endpoint -> Agent Installations

• Endpoint -> Installer

• Paloaltonetworks Community