When a newly installed agent is not reporting telemetry to Cortex XSIAM, which two steps should you check first? (Choose two)

• A.Assigned user permission groups
• B.Agent certificate status
• C.Broker VM version compatibility
• D.Agent connectivity to Cortex gateways

Comment: *

Name: *

Email: *

Verification: *

An XSIAM engineer is tasked with optimizing a correlation rule that triggers on 'Multiple Failed Login Attempts followed by Successful Login from a New Device'. This rule is generating an excessive number of alerts for legitimate user password resets. Which of the following modifications to the XSIAM correlation rule logic would best optimize its performance and accuracy while minimizing false positives for this specific scenario?

• A.Increase the number of required failed login attempts to 20 within a 5-minute window and decrease the time window for successful login to 30 seconds.
• B.Add an exclusion filter to the rule that ignores events where the 'device_id' for the successful login is present in a 'known_user_devices' lookup list and the 'user_agent' matches common browser strings.
• C.Modify the rule to only trigger if the successful login originates from an IP address categorized as 'malicious' by external threat intelligence feeds.
• D.Change the aggregation function for failed login attempts from 'count' to 'sum' and introduce a 'group by' clause for 'application_name'.
• E.Create a separate suppression rule that silences alerts for 24 hours if a user performs a password reset via the organization's self-service portal.

Comment: *

Name: *

Email: *

Verification: *

An organization is deploying a new web application and wants to ensure robust detection of common web-based attacks using XSIAM.
They have observed several attempts of SQL Injection and Cross-Site Scripting (XSS) during pre-production testing. To optimize their detection content, which of the following XSIAM content management strategies would be most effective for creating high-fidelity detection rules for these attack types, leveraging both IOCs and BIOCs?

• A.Rely solely on out-of-the-box XSIAM rules for web attacks, as they are generally comprehensive.
• B.Create custom IOC rules based on known malicious IP addresses and URLs found in threat intelligence feeds related to web attacks.
• C.Develop BIOC rules that analyze web server logs for unusual HTTP request parameters, abnormal response codes, and sequences of requests indicative of SQLi or XSS payloads, while also incorporating IOCs for known attack patterns.
• D.Implement a simple keyword-based search in XSIAM for common SQLi keywords like 'SELECT FROM' and XSS keywords like '<script>'.
• E.Configure network-based firewalls to block all traffic containing 'SQL' or 'XSS' in the payload.

Comment: *

Name: *

Email: *

Verification: *

A Cortex XSIAM tenant is experiencing intermittent data ingestion failures from a critical endpoint protection platform (EPP) integration. The integration status in XSIAM UI shows 'Connected', but no new security events are appearing in the 'All Incidents' view for the past 2 hours. Checking the EPP's native console confirms events are being generated. Which of the following is the MOST LIKELY initial step to diagnose this issue, considering minimal disruption?

• A.Restart the entire Cortex XSIAM tenant to clear any potential transient errors.
• B.Review the XSIAM 'Integrations' log for the specific EPP integration for errors or warnings.
• C.Directly restart the EPP's integration service on the source system.
• D.Check the network connectivity between the EPP's integration point and the Cortex XSIAM cloud endpoints using ping and traceroute.
• E.Verify the API key or credentials used by the EPP integration in XSIAM and regenerate them if necessary.

Comment: *

Name: *

Email: *

Verification: *

A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero- day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5.
Which XQL query will provide the required result?

• A.
• B.
• C.
• D.

Comment: *

Name: *

Email: *

Verification: *