XSIAM EngineerPreview

In which two locations can correlation rules be monitored for errors? (Choose two.)

A Cortex XSIAM engineer plans to add Kafka and Syslog Collectors to a Broker VM cluster.
What are two expected behaviors of the applets when they are added to the cluster? (Choose two.)

A Cortex XDR agent is installed on an endpoint, but the agent is unable to download content updates and has not registered with the Cortex XSIAM server. An engineer troubleshoots the network connection and determines that, by design, this endpoint does not have direct internet access to the required network destinations for the Cortex XDR agent traffic.
A Broker VM that has the local agent settings applet enabled with Agent Proxy configured is reachable by the endpoint. The Broker VM details are as follows:

FQDN: crtxbroker01.company.net -

Proxy listening port: 8888 -
How should the engineer configure the Cortex XDR agent to use the existing Broker VM as a proxy for the agent network traffic?

In the Incident War Room, which command is used to update incident fields identified in the incident layout?

Which cytool command will look up the policy being applied to a Cortex XDR agent?

What should be considered when creating a custom incident domain?

While using the remote repository on a Development XSIAM tenant, which two objects can be pushed or pulled to the remote repository? (Choose two.)

Which option should be used when customizing a dashboard in Cortex XSIAM to include a widget that will display data filtered by more than one dynamic value?

How will Cortex XSIAM help with raw log ingestion from third-party sources in an existing infrastructure?

How must Cloud Identity Engine be deployed and activated on Cortex XSIAM?

Which common issue can result in sudden data ingestion loss for a data source that was previously successful?

When a Cortex XSIAM playbook execution reaches a breakpoint on a non-manual task, which two actions will allow the playbook to continue? (Choose two.)

What is the purpose of using rolling tokens to manage Cortex XDR agents?

Which two requirements must be met for a Cortex XDR agent to successfully use the Broker VM as a download source for content updates? (Choose two.)

During a new Cortex XSIAM deployment, a user consistently experiences timeout sessions while trying to connect to the agent through Live Terminal, even though the firewall engineer has confirmed that all source IP addresses, port 443, and destinations are allowed.
What could be causing these persistent timeout issues?

A Cortex XSIAM engineer is developing a playbook that uses reputation commands such as '!ip' to enrich and analyze indicators.
Which statement applies to the use of reputation commands in this scenario?

An engineer wants to onboard data from a third-party vendor’s firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to generate a dataset with the firewall data.
How can the analytics capabilities of Cortex XSIAM be used on the data?

Which section of a parsing rule defines the newly created dataset?

Based on the images below, which command will allow the context data to be displayed as a table when troubleshooting a playbook task?

A Cortex XSIAM engineer is preparing to install a new content pack and notices that there are several optional content packs associated with the main one that needs to be installed.
What must the engineer take into consideration when deciding whether or not to install the optional content packs?

When Cortex XDR agents are on servers in a zone with no internet access, which configuration will keep them communicating with the platform?

Which installer type should be used when upgrading a non-Linux Kubernetes cluster?

A security engineer notices that in the past week ingestion has spiked significantly. Upon investigating the anomaly, it is determined that a custom application developed in-house caused the spike. The custom application is sending syslog to the Broker VM Syslog Collector applet. The engineer consults with the SOC analyst, who determines that 90% of the logs from the custom application are not used.
What can the engineer configure to reduce the ingestion?