SecOps ProDemo

By Palo Alto Networks · Question Mode

QuestionQ11

Cortex XDR

An organization needs a particular user to investigate alerts and carry out remediation actions, such as terminating malicious processes and isolating compromised hosts, without granting full administrative control of the tenant settings.

Which predefined Cortex XDR role should be assigned to this user?

  • A Viewer
  • B Investigator
  • C Deployment Admin
  • D Responder
Explanation

The Cortex XDR Responder role provides the operational permissions needed to investigate alerts and take endpoint remediation actions, including terminating malicious processes and isolating compromised hosts, without granting full tenant-settings administration.

Community Discussion

No comments yet. Be the first to start the discussion!