XDR-ENGINEER: Palo Alto Networks Certified XDR EngineerDemo

By Palo Alto Networks · Question Mode

QuestionQ21

Ingestion and Automation

When adding a Palo Alto Networks NGFW to Cortex XDR, what must be done to verify that logs are being ingested successfully after a device has been selected and verified?

  • A Conduct an XQL query for NGFW log data.
  • B Retrieve device certificate from NGFW dashboard.
  • C Confirm that the selected device has a valid certificate.
  • D Wait for an incident that involves the NGFW to populate.
Explanation

Run an XQL query for NGFW log data to confirm ingestion, because Cortex XDR stores PAN NGFW logs in its queryable raw-log data. A valid certificate or the creation of an incident does not demonstrate that log records have arrived in Cortex XDR.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!