An analyst at a SOC using Cortex XDR is overwhelmed by the sheer number of individual alerts generated during an active intrusion. According to the platform's design, which capability most directly reduces the number of separate items the analyst must triage while still revealing the root cause and sequence of events?
Explanation
Related alerts are automatically grouped into incidents to reveal the root cause, reputation and sequence of events all in one place.
Live Terminal stops the spread of infections, removes malicious files and terminates processes without disruption.
automatically grouping hundreds of alerts into incidents, revealing the root cause, timeline of events and threat intelligence details from any alert source
An analyst reviewing the MITRE Engenuity ATT&CK Round 4 results for Cortex XDR wants to describe the quality of its detections. Which statement accurately characterizes those detections?
Explanation
Cortex XDR ® was evaluated for its ability to protect and detect simulations of the Wizard Spide r and Sandworm threat groups real-world attacks.
All (100%) of the detections Cortex XDR delivered were classified as technique-level detections, the highest value detections available in the evaluation.
Locked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to reviewLocked question — unlock this exam to view it.
locked — unlock to review