What is a requirement when integrating Cortex XSIAM or Cortex XDR with other Palo Alto Networks products?
When integrating Cortex XSIAM or Cortex XDR with other Palo Alto Networks products, a XDR/XSIAM Broker VM is required. This Broker VM facilitates secure communication between the Cortex platform and other products, enabling proper integration and data exchange.
Which two areas of Cortex XDR are used for threat hunting activities? (Choose two.)
How does the integration between Cortex Xpanse and Cortex XSOAR benefit security teams?
The integration between Cortex Xpanse and Cortex XSOAR benefits security teams by enabling automatic incident response actions for internet-based incidents. This integration allows security teams to automate the detection, investigation, and response to threats identified through internet-facing assets, improving efficiency and reducing response time.
Which resource can a customer use to ensure that the Cortex XDR agent will operate correctly on their CentOS 07 servers?
A customer can use the Compatibility Matrix to ensure that the Cortex XDR agent will operate correctly on their CentOS 7 servers. The Compatibility Matrix provides detailed information on supported operating systems, versions, and other system requirements for the Cortex XDR agent.
Why is it important to document notes from the Proof of Value (POV) for post-sales hand off?
Documenting notes from the Proof of Value (POV) is crucial for the post-sales handoff because it helps ensure that implementation teams understand the customer use cases and priorities. This documentation provides context for the customer's specific needs, enabling a smoother and more tailored implementation process.
Which two filter operators are available in Cortex XDR? (Choose two.)
Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?
What is the difference between an exception and an exclusion?
What is the difference between the intel feed's license quotas of Cortex XSOAR Starter Edition and Cortex XSOAR (SOAR + TIM)?
The Cortex XSOAR Starter Edition has a more limited capacity compared to Cortex XSOAR (SOAR + TIM). It includes up to 5 active threat intelligence feeds and a maximum of 100 indicators per fetch. In contrast, the SOAR + TIM version typically provides more extensive threat intelligence capabilities.
A customer has purchased Cortex Data Lake storage with the following configuration, which requires 2 TB of Cortex Data Lake to order:
support for 300 total Cortex XDR clients all forwarding Cortex XDR data with 30-day retention
storage for higher fidelity logs to support Cortex XDR advanced analytics
The customer now needs 1000 total Cortex XDR clients, but continues with 300 clients forwarding Cortex XDR data with 30-day retention.
What is the new total storage requirement for Cortex Data Lake storage to order?
Cortex Data Lake (now known as Strata Logging Service in some contexts, but still referred to as Cortex Data Lake for XDR purposes) is the cloud-based storage solution that supports Cortex XDR by storing endpoint telemetry, logs, and analytics data. The customer's storage needs depend on the number of Cortex XDR clients, the subset forwarding data, the retention period, and the type of data stored (e.g., higher fidelity logs for advanced analytics). Let's break down the problem step-by-step to determine the new storage requirement.
Initial Configuration:
Total Cortex XDR Clients: 300
Clients Forwarding Cortex XDR Data: 300 (all clients are forwarding data)
Retention Period: 30 days
Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics
Initial Storage Ordered: 2 TB
This configuration implies that 2 TB was sufficient to support 300 clients, all forwarding data, with a 30-day retention period, including the additional storage needed for advanced analytics logs.
New Configuration:
Total Cortex XDR Clients: 1,000
Clients Forwarding Cortex XDR Data: 300 (unchanged from the initial setup)
Retention Period: 30 days (unchanged)
Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics (unchanged)
The key change is the increase in total Cortex XDR clients from 300 to 1,000, but the number of clients forwarding data remains 300, and the retention period and analytics requirements are unchanged. We need to determine how this affects the storage requirement.
Cortex Data Lake Storage Sizing for Cortex XDR:
Palo Alto Networks provides sizing guidelines for Cortex Data Lake based on the number of endpoints forwarding data, the retention period, and the type of data stored. The storage requirement is primarily driven by:
Clients Forwarding Data: Only the endpoints actively sending telemetry to Cortex Data Lake (e.g., Cortex XDR Pro endpoints with enhanced data collection) contribute significantly to storage needs.
Retention Period: The number of days data is retained directly scales the storage requirement.
Data Type: Higher fidelity logs for advanced analytics (e.g., XDR Pro features like behavioral analytics) increase storage per endpoint compared to basic logs.
Cortex XDR Prevent: Provides basic endpoint protection with minimal data forwarding (e.g., alerts only), typically included in a 30-day retention baseline with minimal storage impact.
Cortex XDR Pro: Includes enhanced endpoint data collection (e.g., process execution, network activity) for advanced analytics, significantly increasing storage needs when enabled.
The problem states that all 300 initial clients were forwarding data, and the same 300 continue to do so in the new setup, with support for advanced analytics. This suggests these are likely Cortex XDR Pro clients, as Pro is required for full telemetry and analytics capabilities.
Storage Calculation:
Palo Alto Networks doesn't publish exact per-endpoint storage figures publicly, but we can infer the requirement from the initial configuration and industry benchmarks:
Initial Setup (300 Clients, 30 Days, 2 TB):
2 TB supports 300 clients forwarding data for 30 days with advanced analytics.
Per client, this approximates to: 2TB300clients=0.00667TB/client2 \, \text{TB} \div 300 \, \text{clients} = 0.00667 \, \text{TB/client} 2TB300clients=0.00667TB/client or 6.67 GB per client for 30 days with higher fidelity logs.
This aligns with typical XDR Pro storage estimates, where enhanced data collection (e.g., 5-10 GB per endpoint per 30 days) is common depending on activity levels and analytics features.
New Setup (1,000 Total Clients, 300 Forwarding, 30 Days):
Clients Forwarding Data: Still 300, unchanged.
Retention: Still 30 days, unchanged.
Analytics Logs: Still required, unchanged.
Storage is driven by the 300 clients forwarding data, not the total number of clients. The additional 700 clients (1,000 - 300 = 700) are not forwarding data, suggesting they might be on Cortex XDR Prevent licenses or not fully activated for data collection, contributing negligible storage (e.g., only alerts, which are minimal).
Thus, the storage requirement remains:
300clients6.67GB/client=2,001GB2TB
Cortex Data Lake Sizing: Palo Alto's sizing tools (e.g., Strata Logging Service Estimator) emphasize active data sources and retention, not total licenses.
Industry Norms: XDR solutions typically require 5-15 GB per endpoint per 30 days for advanced analytics, consistent with the 2 TB for 300 clients.
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)
How does a clear understanding of a customer's technical expertise assist in a hand off following the close of an opportunity?
A clear understanding of a customer's technical expertise helps post-sales teams customize their support and training efforts to match the customer's knowledge level. This ensures that the customer receives the appropriate guidance, training, and resources needed to effectively use the product or solution after the sale.
Which feature of Cortex XSIAM displays an entire picture of an attack, including the originating process or delivery point?
The Causality View in Cortex XSIAM provides an entire picture of an attack, including the originating process or delivery point. It allows security teams to visualize and understand the full sequence of events leading to an attack, helping to identify root causes and mitigate future risks.
A customer has purchased Cortex XDR and requires 24/7 monitoring of the platform. However, the customer only has staff available during business hours.
Which Palo Alto Networks offering would best meet this requirement?
The best option for providing 24/7 monitoring of Cortex XDR, given that the customer only has staff available during business hours, would be Managed Detection and Response (MDR). MDR services provide continuous monitoring, detection, and response to security incidents, even outside of business hours, by leveraging expert security teams to manage and respond to threats when the customer's internal staff is unavailable.
What are two reasons incident investigation is needed in Cortex XDR? (Choose two.)
