Question 111
An internal audit identified a gap in detecting privilege escalation attempts using Windows built-in tools like 'seclogon.exe' (RunAs) or psexec.exe' (Sysinternals) when used by non-administrative users. These tools are legitimate but often abused. The goal is to detect Process.Name' 'seclogon.exe' or 'psexec.exe' being invoked from a standard user context, especially when followed by an attempt to execute a sensitive command on another system or elevate privileges locally. Which XQL query would effectively capture this behavior as a BIOC, minimizing false positives from legitimate IT operations?
Question 112
Question 113
When activating the Cortex XSIAM tenant, how is the data at rest configured with AES 128 encryption?
Question 114
An engineer wants to onboard data from a third-party vendor's firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to generate a dataset with the firewall data.
How can the analytics capabilities of Cortex XSIAM be used on the data?
Question 115
Consider a scenario where an XSIAM dashboard displays 'High Severity Incidents by Category'. The SOC manager wants to add a new widget that shows the 'Average Time to Acknowledge' for these high-severity incidents, broken down by assignee team. Which XQL aggregation and grouping functions are necessary to achieve this within a dashboard widget?
