Online Access Free XSIAM-Analyst Practice Test

In which two locations can mapping be configured for indicators? (Choose two.)

• A.STIX parser code
• B.Classification & Mapping tab
• C.Feed Integration settings
• D.Indicator Configuration in Object Setup

A user navigates to a non-malicious URL. The firewall logs contain information on the network connection, and the endpoint logs contain information on the process that triggered the connection-both of which are ingested into Cortex XSIAM.
What is the term for combining this information upon ingestion?

• A.Stitching
• B.BIOC
• C.Alert grouping
• D.Correlation

An incident in Cortex XSIAM contains the following series of alerts:
10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare
process execution in organization
10:24:18 AM - Low Severity - XDR BIOC - Suspicious AMSI DLL load
location
10:24:20 AM - Medium Severity - XDR Agent - WildFire Malware
11:57:04 AM - High Severity - Correlation - Suspicious admin account
creation
Which alert was responsible for the creation of the incident?

• A.Suspicious admin account creation
• B.WildFire Malware
• C.Rare process execution in organization
• D.Suspicious AMSI DLL load location

What is the cause when alerts generated by a correlation rule are not creating an incident?

• A.The rule has alert suppression enabled.
• B.The rule does not have a drill-down query configured.
• C.The rule is using the preconfigured Cortex XSIAM alert field mapping.
• D.The rule is configured with alert severity below Medium.

Which tab in the XQL search page has information on the various field data types?

• A.Schema
• B.Query Results
• C.XQL Helper
• D.Query Library