A SOC analyst needs to verify the agent state before interpreting endpoint behavior during initial triage. Which option is the best fit?

Question

Accepted Answer

B. Agent status validation. Agent status validation is correct because the official Palo Alto Networks XDR Analyst datasheet maps it to agent operational states. That makes it the best fit when the analyst needs to verify the agent state before interpreting endpoint behavior during initial triage. Agent operational states is not correct because it addresses a different requirement within Endpoint Security Management.

A SOC analyst needs to verify the agent state before interpreting endpoint behavior during initial triage. Which option is the best fit?

Related Questions

Discussion