A correlation rule is created to det

单选题 A correlation rule is created to detect potential insider threats by correlating user login events From one dataset with file access events from another dataset. The rule must retain all user login Events, even if there are no matching file access events, to ensure no login activity is missed. Text Copy dataset = x | join (dataset = y) Top IT Certification Prep Material67.of 74 Exams Prep Paloalto Networks - XDR-Engineer Which type of join is required to maintain all records from dataset x, even if there are no Matching events from dataset y?

A、 Inner

B、 Left

C、 Right

D、 Outer

查看答案

下载APP答题

由4l***nm提供分享举报纠错

相关试题

单选题 Which step is required to configure a proxy for an XDR Collector?

A、Edit the YAML configuration file with the new proxy information

B、Restart the XDR Collector after configuring the proxy settings

C、Connect the XDR Collector to the Pathfinder

D、Configure the proxy settings on the Cortex XDR tenant Top IT Certification Prep Material57.of 74 Exams Prep Paloalto Networks - XDR-Engineer

查看答案

单选题 Which method will drop undesired logs and reduce the amount of data being ingested?

A、[COLLECT:vendor="vendor", product="product", target_brokers="", no_hit=drop] ∗ drop _raw_log Contains "undesired logs";

B、[INGEST:vendor="vendor", product="product", target_dataset="vendor_product_raw",no_hit=drop] ∗ Filter _raw_log not contains "undesired logs";

C、[COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] ∗ drop _raw_log Contains "undesired logs";

D、[INGEST:vendor="vendor", product="product", target_brokers="vendor_product_raw", no_hit=keep] ∗ Filter _raw_log not contains "undesired logs";

查看答案

单选题 During deployment of Cortex XDR for Linux Agents, the security engineering team is asked to Implement memory monitoring for agent health monitoring. Which agent service should be monitored to Fulfill this request?

A、dypdng

B、clad

C、pyxd

D、pmd

查看答案

单选题 An engineer is building a dashboard to visualize the number of alerts from various sources. One of The widgets from the dashboard is shown in the image below: Top IT Certification Prep Material11.of 74 Exams Prep Paloalto Networks - XDR-Engineer The engineer wants to configure a drilldown on this widget to allow dashboard users to select any Of the alert names and view those alerts with additional relevant details. The engineer has Configured the following XQL query to meet the requirement: Dataset = alerts | fields alert_name, description, alert_source, severity, original_tags, alert_id, incident_id | filter alert_name = | sort desc _time How will the engineer complete the third line of the query (filter alert_name =) to allow dynamic Filtering on a selected alert name?

A、$y_axis.value

B、$x_axis.value

C、$x_axis.name

D、$y_axis.name

查看答案

单选题 A new parsing rule is created, and during testing and verification, all the logs for which field Data is to be parsed out are missing. All the other logs from this data source appear as expected. What may be the cause of this behavior?

A、The Broker VM is offline

B、The parsing rule corrupted the database

C、The filter stage is dropping the logs

D、The XDR Collector is dropping the logs

查看答案

单选题 Based on the image of a validated false positive alert below, which action is recommended for Resolution?

A、Create an alert exclusion for OUTLOOK.EXE

B、Disable an action to the CGO Process DWWIN.EXE

C、Create an exception for the CGO DWWIN.EXE for ROP Mitigation Module

D、Create an exception for OUTLOOK.EXE for ROP Mitigation Module

查看答案

单选题 What is the earliest time frame an alert could be automatically generated once the conditions of a New correlation rule are met?

A、Between 30 and 45 minutes

B、Immediately

C、5 minutes or less

D、Between 10 and 20 minutes

查看答案

单选题 Based on the SBAC scenario image below, when the tenant is switched to permissive mode, which Endpoint (s) data will be accessible?

A、E1 only

B、E2 only Top IT Certification Prep Material30.of 74Exams Prep Paloalto Networks - XDR-Engineer

C、E1, E2, and E3

D、E1, E2, E3, and E4

查看答案