A SOC lead wants to choose the Cortex XSIAM capability involved when threat hunting requires querying across the platform without shifting to an unrelated feature. Which choice is best?

Question

Accepted Answer

A. Searches and queries. Searches and queries is correct because Palo Alto Networks ties it to Cortex XSIAM components, capabilities, use cases, and rules. That makes it the best fit when the practitioner needs to choose the Cortex XSIAM capability involved when threat hunting requires querying across the platform. Data ingestion is not correct because it addresses a different requirement within Cortex XSIAM.

A SOC lead wants to choose the Cortex XSIAM capability involved when threat hunting requires querying across the platform without shifting to an unrelated feature. Which choice is best?

Related Questions

Discussion